Discord 2FA: Setup, Backup Codes and Lockout Recovery

Two-factor authentication on Discord, which Discord now calls multi-factor authentication (MFA), adds a second proof of identity after your password: a passkey or security key, a six-digit code from an authenticator app, or an SMS code. You turn it on from User Settings under My Account on desktop or Account on mobile, and Discord then hands you a set of one-time backup codes. Save those codes before anything else, because Discord says its Support team is not able to remove MFA from an account.

We checked this against Discord's Help Center articles on setting up MFA, authenticator apps, passkeys and security keys, MFA lockout recovery, server deletion, Server Discovery and gift cards, plus Discord's Safety Center, in November 2026.

The Three Types of Discord MFA, Ranked

Discord supports three methods and is unusually direct about which ones it prefers. It recommends a security key or passkey, accepts an authenticator app as an established standard, and supports SMS while saying it does not recommend it. You can combine methods, and backup codes cover you whichever you choose.

• Passkeys and security keys. A passkey is an encrypted key you unlock with your fingerprint, face or screen lock, stored in a password manager so it can follow you to other devices. Discord calls this one of the best ways to protect an account because it is phishing resistant. A hardware security key works as a second factor in the same family.
• Authenticator app (TOTP). You scan a QR code or enter a secret into an app such as Google Authenticator or Authy, and the app generates a new code every 30 seconds. Discord warns that not every app syncs or backs up, so losing your phone without backup codes can mean losing the account.
• SMS. Discord's own words are that SMS MFA "is better than no MFA, but not by a lot", because attackers can intercept texts or take over a number through a SIM swap with the carrier. It can only be switched on after an authenticator app is already set up.

For most people the practical setup is an authenticator app as the main method, a passkey added on the devices you use most, and backup codes stored somewhere you can reach without your phone.

Setting Up an Authenticator App

This is the method most accounts start with, and it takes about two minutes. Discord's steps on desktop or browser:

1. Select the cogwheel next to your username to open User Settings on the My Account page.
2. Find the Multi-Factor Authentication options under Password and Authentication and press Enable Authenticator App.
3. Open your authenticator app on your phone and use its camera to scan the QR code Discord shows.
4. Type the six-digit code the app generates into the "Login with your code" box and select Activate.
5. Download the backup codes Discord offers next and store them away from the phone.

On mobile the path is your avatar, then the cogwheel, then Account, then Enable Authenticator App. Because you are already on the phone, you copy the secret key into the authenticator app instead of scanning a code. After activation, Discord offers to link a phone number as a backup for codes. It is honest about the trade-off: that makes losing your app less scary but "reduces how secure your account is". If you want SMS as a fallback anyway, our Discord phone verification guide covers the number rules.

Adding a Passkey or Security Key

Passkeys are where Discord points anyone who wants the strongest setup, and they also allow logging in without typing a password at all.

• Mobile: avatar, cogwheel, Account, Security Keys, then Add. You may be asked for your password or a current MFA code. Your device then offers to save the passkey in a password manager; name it and tap Finish.
• Desktop: User Settings, My Account, Register a Security Key under Password and Authentication, reauthenticate, then press Let's go and follow your operating system's prompt.
• Limit: Discord allows up to 16 security keys and passkeys on an account at the same time, so you can enroll your phone, your laptop and a hardware key.

To sign in with a passkey later, choose "Or, sign in with Passkey" on the login screen if the prompt does not appear on its own, then confirm with Face ID, a fingerprint or your screen lock. Physical security keys work a little differently: Discord says they generally cannot be used for one-step login, so you enter your username and password first and then press Authenticate with security key. If a passkey ever stops working, Discord's fix is to log in another way, delete the old passkey from both your password manager and your Discord account, and enroll a fresh one.

Backup Codes: The Step Everyone Skips

Backup codes are special one-time codes Discord gives you when you turn on MFA. Each is eight digits long and works once in place of your app or key. Discord recommends keeping them in a password manager, or printing them and hiding the paper. They are the only thing standing between a lost phone and a lost account.

• If you skipped the download, go to User Settings, My Account and select View Backup Codes. You will need your password, and the list shows which codes are already used.
• If you downloaded them at setup, look for a text file named discord_backup_codes.txt or a screenshot in your photo gallery.
• After you use a code to get back in, Discord recommends setting MFA up again and generating new codes.
• If the backup code option disappears at a prompt, Discord says either every code has been used or you are trying to use one for something other than logging in, such as registering a passkey.

One more tip: keep at least one copy somewhere that does not depend on the same phone that runs your authenticator. A backup that lives only on the device you lost is not a backup.

Locked Out? What Discord Can and Cannot Do

If you are prompted for a code you cannot produce, Discord's recovery steps are short. At the authenticator prompt, select Verify with something else, then either Use a backup code or, if SMS is set up, Use a code sent to your phone. Once you are in, open User Settings and choose Remove Authenticator App under My Account, then set MFA up again with your new phone.

If you are still logged in on another device, use that session: View Backup Codes (password required), then Remove Authenticator App, then Verify with something else and enter an eight-digit code.

The hard rule is the one people least want to hear. Discord says that without backup codes it is unable to remove MFA or issue new codes, and its X support account lists 2FA removal among the issues it cannot help with. Discord's inactive-account article goes further: if you cannot find your codes, you will have to create a new account. If your authenticator app supports its own cloud backup or transfer, as Google Authenticator and Authy do according to the guides Discord links, set that up today rather than after you lose the phone.

Where Discord Asks for Your Code After You Log In

MFA is not only a login gate. Discord also uses it to protect sensitive actions, which is why an enabled account feels a little different day to day:

• Changing or resetting your password prompts for an MFA code first.
• Deleting a server asks for your 2FA code instead of making you type the server name.
• Servers can turn on a 2FA Requirement for Moderation setting, and Discord makes it a condition for Server Discovery. If a server requires 2FA and the owner has not enabled it, Discord says the owner cannot even delete the server.
• Banning several members at once from the Members page requires your 2FA code or password every time.
• Discord's gift card FAQ says accounts with MFA can hold a higher gift card balance.

What MFA Does Not Stop

MFA blocks someone who only has your password, which covers a huge share of takeovers. It does not protect you from approving a login yourself. Discord's Safety Center warns that a malicious QR code can bypass your password and any 2FA you have configured, because scanning it with your logged-in app approves a new session. The QR Code Login FAQ adds that you should never approve a QR login you did not generate yourself.

The same logic applies to anything that hands over an already logged-in session. Discord's scam page says never to share or screenshare your authorization token, and changing your password invalidates the current token and logs you out of all devices. If something feels wrong, change the password first and then work through our Discord hacked account recovery steps. Fake "free Nitro" links are the most common bait for these tricks, which our guide to real Nitro gifts helps you spot. For accounts that are hard to replace, such as those described in our Early Supporter badge explainer, a passkey plus offline backup codes is the setup worth having.

Securing an Account You Did Not Set Up Yourself

MFA matters most on accounts that cannot be recreated, such as aged accounts and short usernames. The store's Discord hub carries account listings from marketplace sellers, covering accounts from 2015 to 2018, short usernames, Nitro and badges, with verified email or phone in some cases; whatever account you use, enroll your own passkey or authenticator and keep fresh backup codes.

Weigh the platform's position before anything else. Discord's Terms of Service make you responsible for the security of your account, and they also say users agree not to license, sell, lend or transfer their account without Discord's prior written approval. Whichever account you end up protecting, the habits above apply the same way: a passkey on the devices you use most, an authenticator app as the everyday method, and backup codes kept somewhere that does not depend on your phone.

Frequently Asked Questions