How to enable 2FA on Discord: authenticator app, SMS backup, passkeys and backup codes

Discord ranks its own options. It recommends a passkey or security key first because they are phishing resistant: Discord’s engineering blog explains the keys are bound to discord.com, so a look-alike login page has nothing it can ask you for.

An authenticator app is the standard choice, and Discord’s advice is to use one if you can’t use passkeys. Check whether your app backs up or syncs its codes. Discord warns that not all of them do, and that losing the phone without your backup codes might mean you can’t log in.

SMS comes last. In Discord’s words, SMS MFA is better than no MFA, but not by a lot, because attackers can intercept texts or move your number to their own SIM. Discord also says linking a phone makes the account less secure, even as it makes a lost authenticator less scary.

Our pick for most players: an authenticator app, a passkey on the phone you use every day, and backup codes saved somewhere off that phone. Add SMS only if you want a phone number on the account, for example for servers that require one.

Discord backup codes are 8-digit, one-time codes. Each one gets you past the MFA prompt once, then it is spent. The View Backup Codes screen marks which ones you have already used, and Discord’s help pages do not say how many come in a set, so count yours and generate a new set before you run low.

If you saved them during setup, look for a file named discord_backup_codes.txt or a screenshot in your photos. Those are the two places Discord tells people to check.

A few limits are worth knowing. Viewing the codes asks for your password. They work for logging in and managing your account identity, but not for everything: Discord gives registering a passkey as an example where a backup code is not accepted. And if the backup code option disappears from the login prompt, you have used them all.

Discord recommends keeping the codes in a password manager, or printing them and hiding the paper. Do not keep the only copy on the phone that runs your authenticator.

What you can do depends on what you still have. Work down this list in order.

A server owner can require 2FA for moderation. With it on, every moderator and administrator needs 2FA on their own account before they can take admin actions, such as deleting messages. Discord says this protects the server from someone who takes over a mod’s or admin’s account and then tries to make unwanted changes.

The owner switches it on in the Safety Setup section of Server Settings, and needs 2FA on their own account first. If you just got a mod role and some actions are blocked, set up 2FA with the steps above.

Safety Setup also holds the server’s verification level. At the highest level, members need a verified phone number on their Discord account before they can chat.

Discord suggests a password manager for backup codes, and its MFA blog notes that some credential managers can hold passkeys and authenticator codes too. LoginScout is an encrypted vault built for gaming logins: one card per account, holding the login, notes and authenticator (TOTP) codes.

Keeping the password and the authenticator secret in one vault is convenient, but it puts both factors behind one unlock. If that bothers you, keep the authenticator on your phone and only the backup codes in the vault.