The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If someone may have accessed your Discord account, secure the email address linked to it first, then use Discord’s email-recovery link if the address was changed. If you can still sign in, immediately set a unique password, enable multi-factor authentication (MFA), and revoke unfamiliar authorized apps. If you are locked out, use Discord’s official hacked-account report rather than anyone claiming to be support inside the app.
The order matters: the linked email controls recovery, a malicious app authorization can survive a password change, and an infected device can steal any new credentials you enter.
Immediate response: the safe order of operations
Work through these actions in order. If the computer or phone you normally use shows signs of malware, use a different device you trust for the account and email changes.
- Secure the email account currently or previously linked to Discord.
- Look for Discord’s email-change notice and use its recovery link if one arrived.
- If you still have access, change the Discord password to a unique one.
- Turn on MFA and store the backup codes privately.
- Revoke every Authorized App or integration you do not recognize.
- Scan the device that may have exposed the account.
- If you cannot sign in, submit Discord’s official hacked or compromised account report.
Secure the email account before touching Discord
Your email account is the control point for Discord recovery. Anyone who controls it can receive password-reset messages or intercept the notice that lets you undo an unauthorized Discord email change.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Change the email password and add MFA
Sign in to your email provider from a known-clean device, change the password, and make it unique. Do not reuse the new Discord password or an old password used on another service. Enable the email provider’s MFA and review its recovery addresses, phone numbers, forwarding rules, and active sessions for changes you did not make.
If you cannot secure the email account, recover that account with its provider before relying on Discord recovery. A Discord password reset message goes to the email address currently associated with the Discord account, so a reset will not help if an attacker controls that mailbox.
Protect Discord recovery messages
Do not forward a Discord recovery email or share its link, password, MFA code, or backup code. Treat a recovery link as a credential: anyone who uses it may be able to take control of the account.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf the Discord email address was changed
Discord sends a uniquely generated recovery link to the previous email address when the account email is changed. Discord Support says that link remains valid for 48 hours. Open it only after securing the old mailbox, and use it as soon as possible.
What the recovery link does
Completing the recovery flow reverts the Discord email address and requires you to create a new Discord password. It also logs the account out on all devices and removes the phone number and MFA methods as a protective measure. Afterward, add your phone and MFA methods again and generate or retrieve new backup codes.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Using the recovery link invalidates later recovery links. Discord says an expired link cannot be reissued by its support team, so do not wait while trying random links or responding to people who offer to “restore” the account.
How to recognize a real recovery situation
The message should arrive at the previous address because that is where Discord directs this particular recovery link. Do not enter your password into a page reached from an unsolicited message unless you have verified that you are using Discord’s own sign-in and support flow. If the link has expired, proceed to the official hacked-account report instead of paying or giving credentials to a supposed helper.
Change the Discord password while you are still signed in
If your Discord session still works, change the password before investigating anything else in the account.
- Open Discord’s account settings and choose the password-change option.
- Enter the current password if Discord requests it, then create a new password that is not used anywhere else.
- Save the new password in a reputable password manager rather than in a chat, note shared with others, or browser profile you do not control.
- Sign in again only through the official Discord application or website.
Discord’s published minimum is eight characters, with possible additional requirements in some regions. A longer, unique password generated by a password manager is safer than a short password with predictable substitutions. Because an attacker may know an old password, do not merely change one character or append a number.
If you are not signed in, a password-reset email is sent to the address currently on the account. Discord states that its support team cannot reset a password for you; use the account-recovery route rather than asking an in-app contact to do it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enable MFA and preserve a way back in
MFA prevents a stolen password from being sufficient on its own. Discord supports passkeys or security keys, authenticator apps, and SMS. Discord recommends security keys, describes passkeys as phishing-resistant, and does not recommend SMS as the preferred method.
MFA choices
| Method | Protection characteristics | Recovery concern | Discord-specific detail |
|---|---|---|---|
| Passkey | Discord describes passkeys as phishing-resistant because the sign-in proof is bound to the device or credential manager rather than typed into a site. | You need access to the device or passkey provider. Keep another approved recovery method and backup codes. | Supported where your device or password manager supports passkeys. |
| Security key | A physical security key is designed for strong, phishing-resistant sign-in. | Loss or damage can prevent sign-in unless you registered another key or retained backup codes. | Discord recommends security keys; no particular brand or model is required. |
| Authenticator app | Generates time-based codes separately from Discord. It is generally more robust than relying on text messages, but a fake sign-in page can still trick you into disclosing a code. | Moving or losing the phone can lock you out without backup codes or another configured method. | Set this up before SMS; Discord’s SMS option is available only after an authenticator app has been configured. |
| SMS | Works through your mobile number, but Discord does not recommend it as the preferred MFA method. | It depends on access to the phone number and mobile service. | Available only after an authenticator app is set up. |
| Backup codes | One-time recovery credentials, not a replacement for MFA. | Each code works once. Losing the entire set can leave you without a recovery path. | Store them privately, preferably in a password manager, and never send them to another person. |
Set up MFA without creating a lockout
- In Discord account settings, open the MFA or security section and select the method you can reliably access.
- Complete the enrollment challenge and verify that Discord accepts the method.
- Generate or display your backup codes.
- Store the codes in a password manager or another private, offline-safe location. Do not store the only copy on the phone you may lose.
- If you register a key or passkey, add a second recovery option when Discord allows it and keep the backup codes anyway.
Discord’s MFA recovery guidance says support cannot remove MFA or issue new backup codes when you have no saved backup codes. Do not enable MFA and then discard the codes; they are the difference between a recoverable lost phone and a permanent lockout.
Revoke unfamiliar Authorized Apps
A password change does not tell you whether an application or integration was granted access. Open Discord’s Authorized Apps area and inspect every entry.
What to remove
- Revoke any application you do not recognize.
- Remove an app you authorized only once for a giveaway, game, utility, or “verification” prompt if you no longer need it.
- Pay attention to entries added around the time you clicked a suspicious link or noticed unusual messages.
Keep only applications you intentionally use and can identify. If you are unsure, revoke first; you can authorize a legitimate app again later through its normal, verified process. Discord lists this review as a specific step for a compromised account.
Check the device that may have exposed the account
Credential theft can continue if the device is infected. Discord’s compromised-account guidance specifically recommends running a Windows Defender scan on Windows.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Windows check
- Update Windows security intelligence and the Defender application.
- Run a full scan, not only a quick scan, and let it complete.
- Quarantine or remove anything Defender identifies, then restart and scan again if requested.
Do not open unknown links, attachments, or downloads while you are recovering the account. If malware signs remain after the scan, follow the current security and recovery instructions from your device manufacturer or operating-system provider. The Discord guidance does not provide one complete remediation procedure for every operating system, so do not assume that a clean Discord password change proves the device is safe.
Use a known-clean device when necessary
If you see unexpected browser extensions, repeated pop-ups, unfamiliar remote-control software, or security tools being disabled, stop entering new passwords on that device. Use a trusted phone or computer to secure the email and Discord accounts, then remediate the affected device before using it for sensitive sign-ins again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when you are locked out
Use Discord Support’s official hacked or compromised account reporting route. Start from Discord’s support site by navigating to the account-compromise form yourself, not through a link sent by a stranger.
If the account email changed
Search the previous email account for Discord’s 48-hour recovery message. If the link is still valid, secure the mailbox and complete it. If it has expired, Discord says support cannot issue it again; submit the hacked-account report and explain that the email-change recovery window has passed.
Recommended Free Tools
If MFA is blocking sign-in
Try a saved Discord backup code. If SMS MFA had already been configured, use the SMS recovery option Discord presents. Without backup codes or an already configured recovery method, Discord says it cannot remove MFA or create new backup codes for you. Do not claim that support can bypass this control.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
If you cannot receive the password-reset email
The reset message goes to the email address currently associated with the account. Check that mailbox’s spam and filtering rules, but do not assume a missing message means the account is safe. If the email was replaced, use the compromised-account route and the previous-address recovery process instead of repeatedly requesting resets.
Recognize and avoid recovery scams
People who take over accounts often impersonate support, moderators, friends, or “recovery experts.” Discord’s current support guidance says its staff will not contact users directly through the app about support issues.
- Do not provide a password, MFA code, backup code, recovery link, payment, identity document, or email-change confirmation to an in-app contact.
- Do not install remote-access software at someone else’s request.
- Do not click a “verification” link sent in a direct message when you can open Discord Support yourself.
- Do not let anyone persuade you to change your email, disable MFA, or authorize an unfamiliar app as a condition of recovery.
Messages demanding personal information, money, or credential changes are not a reason to bypass Discord’s official process. Report the account or message through Discord’s available reporting tools after your own account and email are secured.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rebuild protection after access is restored
Email recovery deliberately removes phone and MFA methods, so restoration is not complete when you can sign in again.
- Set a unique Discord password if the recovery flow required a temporary or newly chosen one.
- Re-add your phone number only if you want it associated with the account.
- Enroll a passkey, security key, or authenticator app, then keep the backup codes in a private password manager.
- Review Authorized Apps again and revoke anything unfamiliar.
- Confirm that the account email is the address you control and that your email account still has MFA.
- Finish scanning and cleaning the device that may have been compromised before using it for further account changes.
Keep a current copy of backup codes whenever you change MFA devices. A code is single-use, so mark used codes as unavailable and replace the set through Discord’s security settings when the service offers that option.
Common mistakes that make recovery harder
- Starting with Discord instead of email: an attacker who still controls the mailbox can undo your changes.
- Using the same password elsewhere: a breach on another service can immediately expose the new Discord password.
- Waiting on the email-change notice: the recovery link is limited to 48 hours and cannot be reissued after expiration.
- Forgetting that email recovery removes MFA: the account may be accessible but temporarily less protected until you enroll MFA again.
- Deleting or losing backup codes: Discord cannot remove MFA or issue replacements when you have no saved codes.
- Leaving an unknown Authorized App connected: the password can be new while the unwanted authorization remains.
- Recovering on an infected device: malware can capture the credentials you just created.
- Trusting an in-app “support” contact: Discord says support staff do not initiate support contact through the app.
When the account may have sent messages
If friends or servers received unexpected links, files, or requests from the account, tell them through a channel you trust that those messages should be ignored. Do not ask them to click a link to help you recover the account. Secure the account first, then remove any suspicious Authorized Apps and complete the device scan so the activity does not continue.
Support pages and changing interface labels
Discord updates its help-center instructions and in-app labels. The relevant pages used for this procedure include “Minha conta do Discord foi hackeada ou comprometida” (updated December 19, 2025), “How to Reset or Change Your Forgotten Password on Discord” (updated August 18, 2026), “Setting up Multi-Factor Authentication” (updated August 18, 2026), and “How to Recover Your Discord Account When Locked Out of Multi-Factor Authentication (MFA)” (updated August 18, 2026). If a label differs in your app, use the equivalent account-security, Authorized Apps, MFA, or support option rather than following an unofficial workaround.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
