Short answer: To set up 2FA on Discord, open User Settings → My Account and click Enable Two-Factor Auth. Scan the QR code with your authenticator app, enter the six-digit code and your password, then download your backup codes. If you moderate or own a server, this is not optional — Discord requires 2FA for administrative actions on servers with the requirement enabled.
Why Discord accounts get targeted
A stolen Discord account is a launchpad. Attackers use it to message every server you are in with crypto scams, fake Nitro giveaways, and malware links — all carrying your name and avatar, so people click. Gaming accounts attract the same treatment, which is why 2FA on Steam is worth setting up as well.
If you moderate a server, the damage escalates. An attacker with admin rights can mass-ban members, delete channels, or post scam links pinned across a community of thousands.
The most common attack is a DM offering free Nitro, a game beta, or claiming you have been reported — with a link to a page that looks exactly like Discord’s login. There is also a persistent token-stealing malware problem, which 2FA does not stop. More on that below.
Setting it up
- Open Discord on desktop or web.
- Click the gear icon next to your name → My Account.
- Click Enable Two-Factor Auth.
- Enter your password.
- Discord shows a QR code. Scan it with your authenticator app, or click to reveal the text key and paste it manually.
- Enter the six digits your app generates.
- Click Activate.
Do not screenshot the QR code. It holds your raw secret key, and anyone with that image can generate your codes forever. If you want a spare, scan it into a second app while it is displayed.
No app yet? See our comparison of authenticator apps.
Download your backup codes immediately
Discord shows a set of backup codes right after activation, and offers a download button. Take it.
Store them offline or in an encrypted password manager — not in a Discord DM to yourself, which is where a surprising number of people put them. Our guide on where to store backup codes safely ranks the options.
Discord support can be slow and account recovery is not guaranteed, particularly if you lose access to the registered email as well.
Add a security key too
Under the same settings, you can register a hardware security key or a passkey. Worth doing if you moderate anything meaningful.
The reason is specific: a TOTP code can be relayed by a real-time phishing page within its 30 seconds. A security key is bound to discord.com and will not sign for a lookalike domain. Given how phishing-heavy Discord is, this matters more here than on most platforms. See hardware security keys explained.
The thing 2FA does not fix: token theft
Discord’s biggest security problem is not password theft. It is token stealing.
Your Discord client holds a session token that proves you are already logged in. Malware — usually delivered as a “game,” a “mod,” or a cracked program from a DM — reads that token from your computer and sends it to an attacker. They then use it to access your account without ever logging in, which means 2FA is never triggered.
2FA cannot help with this. What helps:
- Never run executables sent through Discord, no matter who appears to have sent them. Compromised friend accounts are the primary delivery method.
- Change your password if you suspect infection. This invalidates all existing tokens — it is the only reliable way to kill a stolen one.
- Check Settings → Devices and log out anything unfamiliar.
- Be sceptical of “free Nitro.” It is the single most common lure on the platform.
For server owners and moderators
In Server Settings → Safety Setup, you can require 2FA for moderation actions. Any moderator without it loses the ability to ban, kick, or manage channels until they enable it.
Turn this on. It is the main protection against one compromised moderator account taking down a community. Give your team notice first so nobody is caught out mid-shift. Moderators who stream should do the same on their broadcasting account — see how to set up 2FA on Twitch.
Frequently asked questions
Can I use Google Authenticator with Discord?
Yes. Discord uses standard TOTP, so any authenticator app works — Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, or a password manager with TOTP.
What if I lose my phone?
Use one of your downloaded backup codes. Without them, you will need Discord support and access to your registered email. See recovering accounts after losing a 2FA phone.
Does Discord support SMS 2FA?
Discord offers SMS as a backup on some accounts, but it is weaker and vulnerable to SIM swapping. Use the authenticator app as your primary method.
Why is my Discord code invalid?
Almost always clock drift. Enable automatic network time on your phone. Other causes are in why 2FA codes get rejected.
Will enabling 2FA log me out?
No. Existing sessions continue. You will be asked for a code on new logins and for sensitive account changes.
Can I disable it later?
Yes, in My Account — but you will lose moderation permissions on any server that requires it.
The bottom line
Enable the authenticator, download the backup codes, and add a security key if you moderate. Then internalise the part 2FA cannot cover: do not run files people send you on Discord. Token theft bypasses every setting on this page, and it arrives looking like a message from a friend.