Recommended Free Tools
If you think someone accessed your Discord account, secure the email address attached to it first. Then use Discord’s email-recovery link if the address was changed; otherwise change your Discord password, enable multi-factor authentication (MFA), revoke unfamiliar authorized apps, and inspect the device you were using. If you are locked out, use Discord’s official hacked-account report rather than replying to an in-app impersonator.
The order matters: control of the email account determines whether you can recover Discord, and a compromised device can expose every new password or MFA code you enter.
As an Amazon Associate I earn from qualifying purchases.
1. Secure the email account connected to Discord
Your email account is the first recovery boundary. Discord sends password-reset messages to the email address currently associated with the account, and its email-change recovery process sends a special reversal link to the previous address. If the email account itself is exposed, an attacker may be able to intercept both messages.
- Change the email account’s password to a unique password that you do not use anywhere else.
- Turn on MFA for the email provider, preferably with a passkey, security key, or authenticator app supported by that provider.
- Review recent sign-ins, active sessions, forwarding rules, recovery addresses, and phone numbers in the email account. Remove anything you do not recognize.
- Do not forward or share a Discord recovery message. Treat its link like a password.
Complete these checks from a device you trust. If the computer or phone you used may contain malware, use a different, updated device for recovery until the original has been checked.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Also check whether the mailbox has rules that automatically archive, delete, or forward Discord messages. An intruder may leave the password unchanged while silently diverting security notices. Remove unfamiliar browser sessions and connected mail applications, then change the mailbox password again after any suspected malware has been removed.
2. If Discord says its email address was changed
Discord’s email-change notice includes a recovery link sent to the previous email address. Discord Support says the link is valid for 48 hours. Use it as soon as possible; an expired link cannot be reissued by Discord Support.
What the email-recovery link does
Completing the recovery process reverts the Discord email address, requires you to create a new Discord password, logs the account out on all devices, removes the account’s phone number and MFA methods, and invalidates later recovery links. Removing phone and MFA methods is a security measure in the recovery flow, but it means you must set them up again after signing in.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use the link safely
- Open it only from the email you expected and check that the destination is an official Discord page before entering anything.
- Never send the link to a person claiming to be a moderator, employee, or “recovery agent.”
- After the email is restored and the new password is accepted, sign in and immediately rebuild MFA and phone protection.
If the link has expired, proceed through Discord’s official hacked-account reporting route. Do not pay anyone who promises to generate another link.
Because the recovery process invalidates later recovery links, use the newest legitimate notice and do not keep retrying old messages. If you receive several notices, secure the previous mailbox first, then follow the link from the message that is still within its 48-hour window.
3. If you can still sign in, change the Discord password
Change the password before investigating messages, servers, or settings. A password reset email goes to the address currently attached to the account. Discord states that its support team cannot reset a user’s password for them.
- Open Discord’s account settings and select the password-change option for your account.
- Enter a new password of at least eight characters. Discord notes that additional requirements may apply in some regions.
- Make the password unique to Discord. Do not reuse one from your email, gaming, social-media, or banking accounts.
- Save it in a reputable password manager so you do not have to reuse or weaken it later.
Changing the password is necessary but not sufficient. An attacker may still have an authorized application, an active session, access to your email, or a copy of your MFA recovery codes.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you reused the old Discord password anywhere else, change those accounts too, starting with email and financial or identity-related services. Do not copy a password from a message, support ticket, or direct message; enter it only into the official Discord app or website that you opened yourself.
4. Turn on MFA and preserve a recovery path
Discord supports passkeys and security keys, authenticator apps, and SMS. Discord recommends security keys, and its MFA guidance describes passkeys as phishing-resistant. SMS is supported but Discord does not recommend it; SMS becomes available only after an authenticator app has been configured.
MFA choices
| Method | What Discord’s guidance establishes | Recovery considerations |
|---|---|---|
| Passkey | Supported; Discord describes passkeys as phishing-resistant. | Keep a second recovery method and backup codes in case the device or synced credential is unavailable. |
| Security key | Supported and recommended by Discord. | Have a spare compatible key or another recovery method, and retain backup codes. |
| Authenticator app | Supported and required before SMS can be enabled. | Protect access to the authenticator device and store Discord backup codes separately. |
| SMS | Supported after an authenticator app is set up; Discord says it does not recommend SMS. | Depends on access to the configured phone number; keep backup codes for situations involving lost service or a changed number. |
| Backup codes | One-time-use recovery credentials, not a replacement for primary MFA. | Store them privately, preferably in a password manager. Discord cannot issue new codes when you have none. |
Enable MFA without locking yourself out
- In Discord’s account security settings, choose the MFA setup control.
- Prefer a passkey, security key, or authenticator app. Follow the on-screen enrollment and complete the verification challenge.
- Generate or view your Discord backup codes immediately after setup.
- Store the codes in a password manager or another private location that is not the same device you are protecting.
- Test that you can access the chosen recovery method before signing out of all devices.
Do not photograph backup codes, paste them into a public server, or send them to anyone offering technical support. Each code is a credential and can be used once.
Choose based on both security and recoverability. A security key or passkey offers stronger resistance to phishing, but you must plan for a lost key or unavailable device. An authenticator app may be simpler to deploy, while SMS is a fallback Discord supports only after authenticator setup and does not recommend. Keep backup codes available whichever primary method you select.
5. Revoke unfamiliar Authorized Apps
Discord’s compromised-account instructions specifically call for reviewing Authorized Apps. Open that section in account settings and remove every application or integration you do not recognize, or that you no longer need. Read each entry rather than assuming that a familiar-looking name is legitimate.
Revoking an app cuts off the authorization granted to it, but it does not clean an infected computer or change a password stolen by malware. Complete this step after changing the password and before reconnecting optional integrations.
Record the names of anything suspicious before removing it if you may need to describe the incident to support. Do not reinstall an integration merely because a server moderator or bot message tells you to “verify” it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Check the device that may have been compromised
A suspicious link, download, browser extension, or game modification can expose credentials even after you change them. Discord recommends running a Windows Defender scan on Windows and warns users not to open unknown or untrusted links and downloads.
Windows check
- Update Windows Defender definitions and the operating system.
- Run a full Windows Defender scan, not only a quick scan, if you suspect a malicious download or credential theft.
- Quarantine or remove anything the scan identifies, then restart and scan again if the security tool requests it.
- Review browser extensions and installed applications; remove software you did not install or cannot verify.
The cited Discord guidance does not provide a complete remediation procedure for every operating system. If signs of malware remain on macOS, Linux, Android, iOS, or another platform, follow the device maker’s current security instructions or consult a qualified security professional. Do not enter your new Discord or email password on a device you still suspect.
Keep the suspicious device offline while you decide what to do if you see active remote-control software, repeated credential theft, or security tools being disabled. Use a clean device to change credentials, and update the original device before signing back into Discord.
7. If you are locked out of Discord
Use Discord Support’s official hacked or compromised account reporting form. Start from Discord’s support site by navigating to the account-compromise reporting option rather than using a link sent by another user.
Information to include
- The email address that was previously attached to the Discord account.
- Whether you received an email-change notice and whether its 48-hour link is still valid.
- When you last had access and what changed afterward.
- Any relevant account identifiers or transaction details requested by the official form.
- A concise description of suspicious messages, links, downloads, or device activity.
Use the email account you secured earlier when communicating with support. Do not send your password, MFA code, backup codes, recovery link, or payment to anyone who contacts you inside Discord.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesKeep the report factual and concise. Explain the sequence of events, identify the account email before the change, and mention whether the recovery link expired. Do not create multiple conflicting stories or attach secrets that the form did not request.
8. Recovering from an MFA lockout
If MFA blocks sign-in, try a saved Discord backup code first. SMS may work only if you had already configured it after setting up an authenticator app. Discord says it cannot remove MFA or issue new backup codes when you have no saved backup codes, so do not assume support can bypass the protection.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When a device or key is lost
- Check your password manager or other secure storage for the backup codes created during MFA setup.
- Check whether your passkey is synchronized to another supported device.
- Use a spare security key if you enrolled one.
- If SMS was previously configured, verify that you still control the associated number.
If none of these options is available, submit the official compromised-account report, but avoid promising yourself that MFA will be removed. Discord’s published recovery guidance specifically warns that support cannot provide new backup codes when the existing ones are unavailable.
9. Rebuild protection after you regain access
Email recovery removes phone and MFA methods, so a recovered account is not fully protected until you add them again.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Set a unique Discord password and save it in your password manager.
- Enable a passkey, security key, or authenticator app, then generate and securely store new backup codes.
- Add a phone number only if you want that recovery option and can keep the number secure.
- Review Authorized Apps and remove anything unfamiliar.
- Review account email, username, profile details, connected services, and server memberships for changes you did not make.
- Tell contacts or server moderators that suspicious messages from the account may not have been yours; ask them not to open links sent during the compromise.
- Change passwords for other services if you reused the old Discord password or entered it on a suspicious page.
Check for outbound messages, changed profile details, unfamiliar connected services, and new server memberships. Warn people who may have received links from the account, because deleting a message does not undo a click or download.
10. Avoid fake Discord support
Discord’s current compromised-account guidance warns about unsolicited requests for personal information and payment. Official Portuguese-language support guidance also says Discord support staff will not contact users directly through the app about support issues.
- Ignore anyone in a direct message who claims to be Discord Support and asks for your password, MFA code, backup code, recovery link, or payment.
- Do not “verify” an account by clicking an unknown link or downloading a file.
- Do not give a stranger control of your screen or computer.
- Submit requests through Discord’s official support website and keep the confirmation details.
A legitimate helper does not need your secret credentials. If you already shared one, change the affected password from a clean device, revoke unfamiliar Authorized Apps, and replace compromised MFA or recovery information.
11. Common symptoms and the right response
| Symptom | Best next action |
|---|---|
| You received an email saying Discord’s address changed. | Secure the old email account and use the recovery link within 48 hours. |
| You can sign in, but messages or settings look unfamiliar. | Change the password, enable MFA, revoke unknown Authorized Apps, and inspect the device. |
| Password reset messages never arrive. | Check the email address currently associated with the account and secure that mailbox; Discord Support cannot reset the password for you. |
| Your MFA device is unavailable. | Use a saved backup code, a configured SMS method, a passkey on another device, or a spare security key. |
| You have no backup codes and MFA blocks access. | Use Discord’s official locked-out-of-MFA guidance and do not expect support to issue replacement codes. |
| A person claiming to be support asks for credentials or money. | Stop communicating, report the impersonator, and use the official support form yourself. |
12. Make the account harder to compromise again
Use a password manager to generate a different password for Discord and your email account. Keep your operating system, browser, Discord client, and security software updated. Treat unsolicited “free Nitro,” giveaway, moderation, verification, and account-warning links as untrusted until you verify them independently.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use MFA that you can realistically recover: a passkey or security key can provide strong phishing resistance, while an authenticator app may be easier to deploy. Whichever method you choose, preserve backup codes before an emergency. Consider enrolling a spare security key or maintaining a second supported recovery device, but never store both the primary credential and every backup in one place.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Review Authorized Apps periodically, especially after joining new servers or connecting bots and external services. Limit integrations to those you recognize and still use. If a device ever prompts you to disable security software, install an unknown “verification” tool, or paste commands into a terminal, stop and investigate before proceeding.
Official guidance used for these steps
Discord Support’s relevant pages include its compromised-account guidance updated December 19, 2025; its email-change recovery article describing the 48-hour link; “How to Reset or Change Your Forgotten Password on Discord,” updated August 18, 2026; “Setting up Multi-Factor Authentication,” updated August 18, 2026; and “How to Recover Your Discord Account When Locked Out of Multi-Factor Authentication (MFA),” updated August 18, 2026. Discord notes that settings labels and recovery behavior can change, so follow the current wording shown in the app and support site.
Frequently Asked Questions
What should I do first if my Discord account was hacked?
Secure the email account linked to Discord first, including its password, MFA, sessions, forwarding rules, and recovery details. Then use Discord’s 48-hour email-recovery link if the address changed, or change the Discord password if you can still sign in.
What if my Discord email was changed?
Find Discord’s notice in the previous email account and use the recovery link within 48 hours. The process restores the email, requires a new Discord password, logs out all devices, removes phone and MFA methods, and invalidates later recovery links. Re-add MFA and phone protection afterward.
Can Discord Support reset my password or remove MFA?
Discord says its support team cannot reset a user’s password. It also says it cannot remove MFA or issue new backup codes when you have none. Try a saved backup code, configured SMS, another synchronized passkey, or a spare security key before reporting the lockout.
Which MFA method is best for Discord?
Discord recommends security keys and describes passkeys as phishing-resistant. Authenticator apps are also supported. SMS is supported only after authenticator setup and Discord does not recommend it. Whichever method you use, store backup codes privately and keep a realistic recovery option.
How do I know whether a Discord support message is real?
Do not trust unsolicited direct messages claiming to be support. Discord guidance says support staff will not contact users directly through the app about support issues. Never provide passwords, MFA codes, backup codes, recovery links, personal information, or payment; start from Discord’s official support website yourself.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should I do after clicking a suspicious Discord link?
Change Discord and email passwords from a clean device, enable MFA, revoke unfamiliar Authorized Apps, and inspect the device. On Windows, Discord recommends a Windows Defender scan. Warn contacts about messages sent during the compromise and change any other account password that was reused.
The Bottom Line
Protect the linked email first, use Discord’s 48-hour recovery link if the address changed, then reset the Discord password, enable recoverable MFA, revoke unknown Authorized Apps, and check the affected device. If access is lost, report the compromise through Discord’s official support site and never share credentials or recovery codes with an in-app stranger.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
