Safety
Your Discord token: what it is and how to keep it safe
Why a token is as good as your password, how token-stealing scams work, how to tell a real site from a fake one, and how to revoke a leaked token.
By @B3ni15 · Updated · 8 min read
Most stolen Discord accounts aren’t taken by guessing a password. They are taken with a token, a long string the Discord app uses to prove it is signed in as you. Anyone who has it can act as you without knowing your password and without triggering your two-factor authentication. This guide explains what a token is, how people get tricked into giving theirs away, and what to do if yours leaks.
What a token is
When you sign in, Discord gives your app a token, and the app sends it along with every request so Discord knows who is asking. Think of it as a key cut for one session: your password is how you get a key, the token is the key itself.
That has three consequences worth remembering:
- A token skips your password and 2FA. Those protect the act of signing in. A token is what you get after you have already signed in.
- A token keeps working until it is ended. It doesn’t expire after an hour. It stays valid until that session is signed out or your password changes.
- Discord will never ask for it. Discord staff, bots and “verification” servers have no legitimate reason to ask you for your token, and neither does any giveaway.
How token theft works
“Paste this into your console”
Someone sends a snippet and promises it unlocks a hidden feature, free Nitro or Orbs. Pasting it into your browser’s developer console runs it as you, and it quietly sends your token to them. This is why Discord shows a big red warning when you open the console. Never paste code you didn’t write into it.
Fake verification and QR codes
A new server asks you to “verify” by scanning a QR code. That QR code is a real Discord login request started by the scammer; scanning it with your phone signs them in as you. Only scan a Discord QR code when you are the one signing in, on your own computer, on discord.com.
Malicious downloads
A “game to test”, a cheat, a modded client or a cracked program can include a token grabber that reads the token from your Discord app’s files. If a friend suddenly asks you to try their game, check with them on a different channel first: their account may already be compromised.
Look-alike websites
Pages that copy Discord’s login screen, or that promise free Nitro, Orbs or Quest rewards in return for signing in. Check the address bar: Discord’s own sign-in only ever happens on discord.com.
Protecting your account
- Turn on two-factor authentication in User Settings → My Account. It won’t stop a stolen token, but it stops a stolen password, and it is required to change your email or delete your account.
- Check your devices. User Settings → Devices lists every session signed in to your account. Sign out any you don’t recognise.
- Use a unique password that you don’t use anywhere else, ideally from a password manager.
- Keep your email account secure too. Whoever controls your email can reset your Discord password.
- Be stingy with third parties. Prefer services that use “Sign in with Discord” (OAuth), which never sees your token or password, and only give a token to a service whose risks you have read and accepted.
If you think your token leaked
- Change your password straight away. This ends every session and invalidates every existing token, including the stolen one.
- Review User Settings → Devices and sign out anything left over.
- Check User Settings → Authorized Apps and remove any app you don’t recognise.
- Tell your friends not to trust messages sent from your account in the meantime; stolen accounts are used to spread the same scam.
- If you have lost access entirely, contact Discord Support through the Help Center. Do not trust anyone who offers to “recover” it for you in a DM.
How Disquest Helper handles tokens
Disquest Helper needs a token to run Quests for an account, so we think it is only fair to be specific about what happens to it:
- You sign in to disquesthelper.xyz with Discord’s official OAuth screen, which never gives us your password or token. The token for Quests is a separate, deliberate step.
- The token is encrypted the moment it reaches us, with a key the website itself doesn’t have. Only the worker that runs Quests can decrypt it, in memory, while a run is going.
- We never ask for your token or password by email, DM or anywhere other than the setup page.
- Deleting your account in Settings erases the stored tokens for good. Changing your Discord password ends our access at once, too.
Even so, handing a token to any service is a trust decision, and it isn’t the only risk: read Is automating Discord Quests allowed? and our Privacy Policy before connecting an account.