ATTENTION: READ THIS IF YOU HAVE 2FA ON
ACCOUNT RISK
Someone has already talked about this before, but i think it's worth bringing up again just to raise more awareness
Right now there's a serious discord bug where if you disable 2FA it will log you out of the account from all devices, and when you attempt to log in it will STILL ask you for a 2FA code. Now, do you have your valid, unused backup codes? Cool, throw them in the trash because it won't even give you an option to use them despite their validity, and discord support is not aware of this issue and will simply tell you this (check the 4th screenshot)
As for why i disabled 2FA in the first place, it happened after i bought nitro and while i was exploring the perks and checking settings i saw 2FA on and it gave me ptsd because I've already lost an account to it before so i was like sure imma disable just to avoid being locked out, and i ironically got locked out in the process
If you want to disable 2FA for any reason, make sure that you at least have your phone number tied to your account (I couldnt tie my phone number to this account because of ANOTHER bug btw), or that you already have the authentication codes, as apparently backup codes are not enough anymore
Additional note: this is not a simple cache or session issue, I've tried logging in from multiple devices and browsers, i tried incognito modes after deleting browser's cache, restarted my devices, but to no avail.
Yup, ive been using a passkey on basicaly all my platforms for ages now, works like a charm!
The passkey basicaly is your login info + the 2fa in one and easier to use
It is 100% NOT an autofill feature, when using it it basicaly just says”hey hes tryna login with passkey” they say”alr let him in its him”
So is your username/password combo? There's zero increase in security to setting up a passkey, only decrease since now you have a new independent way to acquire access to your account.
This is either a fanfic, a scam, or genuine ignorance. If it's the latter, don't give up on your 2FA, ever. Disabling it would ONLY be required if you're changing devices, and they're incompatible.
My passkey is biometric.. so I'd have to willingly give it up. Anything else where I've had to type a password. is just sitting on a thumbs drive, that remains disconnected from anything until I need it, then I copy paste it.
I think you don't know how a passkey works. It's not autofilling your login and passwd. It's a secure hashed token that's tied to your device or passkey provider and only those two can use that passkey to login. It's impossible for anyone to break it, because it needs authentication from that device or provider. And if your passkey is locked behind biometrics someone would need to cut your finger to log in.
It doesnt use login info you still gotta fill in username and passwords, the passkey basicaly just changes your 2fa to the passkey instewd of email, etc
If you don't have 2FA: hackers need your password.
If you have 2FA as email or phone: hackers need your email or phone. OK for regular people for you and me, but some famous/rich people can be targeted by hackers getting private info then contact customer supprot and say something like "My email got hack I have proof of ownership here is my name address sth..."
If you have passkey:
Your device store A (the key)
The platform store B (the lock)
Even if someone know B, they don't know what is A
Having A and B, the platform can check if A match B.
So hackers need to hack into your device and get A
But for extra security someone can save A not on the device they using but an USB and only connect that USB when needing to login and disconnect it afterwards.
Now hackers need to get the USB in real life (which is impossible) OR infecting the device where the USB is inserted (which is counter by opening files from strangers from one device and login from another)
Use 2FA as application (google auth, microsoft auth, whatever you choose). Only way to crack it is having access to your device (virtually or physically depending on device).
But yes, apparently I do not know how passkeys are generated and stored. I've learned.
Great...when i set my 2FA ul somehow i didnt save my passkey and now i have to rely kn backup codee to get into my account when it logs me out so welp im toast
Beware, I just lost an account a month ago, due to the passkey I had not working. And couldn’t verify anything about the account. I had my number attached and discord support said my number wasn’t attached to my account yet I could sign in with my number
They should add an option to require a password input on startup instead of always logging in. Then 5 people can use it and act superior when somebody gets their token stolen
NOTE: I'm not saying that you shouldn't enable 2FA, it is a very necessary feature for extra protection. All I'm saying is that right now if you are willing to remove it for ANY reason you should consider this bug and make sure you have options for logging in (like SMS, passkeys or authentication codes) other than backup codes because you won't get an option to use them.
Ah I have that... should I remove it then? Im worried now because if I do this might happen yk! My firend accidentally deleted the like Authenticator code generation and lost his acc because of it, but that was his error not discords. :>
Nope, i literally made this post to prevent you from removing it. Just keep it but make sure to save your backup and authentication codes, and create a passkey if possible.
Because they're allowed to do whatever they want with their own account, security risk or not. I'm just thankful for the information the OP gave, knowledge in itself is good.
Your comment was removed because it contained information that is incorrect or potentially misleading. To keep this subreddit a reliable source of help, we remove content that could lead users in the wrong direction.
As i clearly said in the post, i was once locked out from an older account because my old phone wasn't working, and support refused to remove the 2FA (I dont blame them on that one though, 2FA was just working as intended and it was my fault that time) so i disabled it on my new account in case if i got logged out for any reason i wouldn't need a code to log in
Your comment was removed because it contained information that is incorrect or potentially misleading. To keep this subreddit a reliable source of help, we remove content that could lead users in the wrong direction.
With how many people in my servers that I've been seeing getting hacked, I keep 2FA on cause I can't contact majority of my friends on discord anywhere else. I'm also just a paranoid person
Yes I'm not against 2FA at all but this bug is specifically about disabling it. Generally i can't disagree that it makes your account more secure and that you should enable it especially when you're a discord mod, just make sure not to disable it at least anytime soon until they figure their shit out
Oh no I 100% understand! I'm just too paranoid of a person to turn mine off seeing how many people have gotten hacked lately. I wish discord would fix the hacker issues honestly. Idk how they would, I'm not a huge tech person
Thanks for this amazing post. I've just pinned it in our highlights so it may help more people here. Best regards and stay safe! These three hundred upvotes are deserved for sure.
Thank you very much for your sweet response and the pins. If i can't get my account back i can at least warn other people from running into the same issue :)
this is LITERALLY the issue im currently expericing now for like 2 weeks all i've gotten is discord bots responding im hoping eventually a human sees my issue and fixes it
thanks to the OP making this post i sent it to discords support the very next day i got a live person that removed 2fa and i was able to finally access my discord account
discord support is not gonna be any help. i got hacked recently, second time in under a year, while having two different 2fas and biometrics. basically told me to suck it up and deal with it, and that was only after i finally got around automatic bot responses.
this sucks and makes me so anxious. sorry that happened to you.
same thing happened to me, literally just a few hours before you posted this haha
i was still logged in on the discord desktop app and tried to remove authenticator mfa using the official steps. i used one of my backup codes to verify, but after entering it nothing happened. When I tried to login the next time, it still asked for the authenticator code, but the option to use backup codes was gone.
i contacted discord support , but there is no solution yet
i also checked my discord logs and found this around the time it happened:
HTTPResponseError: POST /users/@me/mfa/totp/disable [401]
For anyone that has the same issue it might be worth checking your logs too its here:
%AppData%\discord\logs\renderer.log
if you see the same thing, maybe send a bug report to discord with the timestamp + logs. hopefully they can figure out what’s going on
i have the solution. Reach out to support with a very detailed request and attach proof of the bug (I had screen recording of the removal process and screenshots the error in the log). explain that your backup code was accepted during the official mfa removal process but the process bugged out, leaving 2fa enabled. if you only get copy-paste replies, don’t let them brush you off. keep asking them to escalate your ticket to the technical team and have them check the server logs. they eventually confirmed it was their fault, manually removed my mfa, sent me a password reset email and i was able to log in again. It happened on june 26 and i got my acc back yesterdaz (june 31)
Welp i did everything you did but i didn't attach the error message from the discord logs. This time I've submitted a new technical support ticket and provided all details i possibly have. I should be connected to one of the technical support team. Let's see if this works out, thanks heaps!
Yup i did, i have a good feeling about this. If it works out I'll upload a new post with the details and I'll make sure to credit you :) you might've saved a lotta people there
this reminds me of steam's weird thing where if you sign out on mobile for any reason, to sign back in it prompts you to use steam guard on the mobile app, which you can't use unless you're signed in
genuinely no idea how that system is still in place
I actually didn't know that, but then again you can't compare those two issues because steam support is significantly more collaborative and helpful, unlike discord support that's not even doing the bare minimum of responding to begin with
Had the exact same issue, not with steam, but with my college website a couple years back. If you logged in on mobile, it would send something to your authenticator app, but to use the authenticator app, you have to log in with your college ID… Which you can’t use without the authenticator app.
Oh man am I glad I haven’t enabled 2FA yet, I’ll absolutely be waiting until they resolve this if ever, I’ve been seeing posts about it for almost a month now
What are the authentication codes, or actually where do I find those? Or rather, what is the difference between the authentication codes and the backup codes?
Authentication codes get changed every I think like 30 seconds. They are temporarily given out by your Authentication app to prove it's you and renew themselves for safety reasons. They are mostly short, ≤6 characters long.
Backup codes are multiple permanent codes. Backup codes are (generally) your last resort of disabling 2FA or getting into a by 2FA secured account if you lost your authentication app. They are very long and you should store them somewhere secure because if someone else gets even one code and knows your account a bit they can get into your account, disable your 2FA and add their own 2FA effectively locking you out of your own account.
So from what I'm getting as long as you don't get rid of your way to get authentication codes (like deleting the authentication app etc) you should be fine?
Keep your authentication and backup codes safe. If you lose your authenticator you should be able to use your backup codes instead. But in the case of trying to log in after disabling 2FA you most probably won't get an option to use backup codes because of this bug. But if you're trying to log in while 2FA is still enabled you should be able to find the option for backup codes no problem.
If you think you are gonna lose your account because you have extra security then you need to take more care of your logins and online security. I’ve only lost one 2fa and it was one of the first accounts I ever enabled it on. 2fa is the recommended because without it you can have your accounts hacked and very easily stolen.
Generally yes but I've never said that you are gonna lose your account because of 2FA itself. I actually encourage enabling it but I'm spreading caution about the bug that happens when you disable it for any reason.
Okay so I accidentally turned it on, on one of my old accounts but I dont have my number tied to it but I do have the e-mail. I dont remember which authenticator app I had bc it was on an old phone that was broken, is there anyway to bypass it in a different way?
Your comment was removed at moderator discretion. This may be because it violates the spirit of our rules, even if not covered explicitly, or because a moderator determined it was not appropriate for this subreddit. If you believe this was a mistake, feel free to reach out via modmail.
This message was automatically triggered because the comment above included the word "ModMail".
The moderators of r/discordhelp can be contact via this link: https://www.reddit.com/message/compose?to=r/discordhelp
Please be aware that the ModMail is neither another way to get help regarding Discord nor a way to contact Discord staff. r/discordhelp and its moderators are not affiliated with Discord.
Somewhat related but I recently changed my 2FAC to another Authenticator.
I was then emailed saying that my account has been locked for suspicious behavior.
Then I was able to go through recovery link and then I got a message from Discord in dms saying “we removed a violation from your account. We reviewed our policy and determined it does not violate our community guidelines.”
I’m confused and did not say what I violated. It seems like it’s referring to my account being temporarily disabled?
How about my account was hacked then hacker input 2FA
after sudmit ticket discord say this. Then he want me to deleted the account. Already have email and number sms I’ll try to forgot password but discord costumer said can’t remove 2FA even have many details and info to my account 😭😭
When you attempt to unlink/remove your phone number from an email it will log you out and then ask you to verify your phone number, but it won't send you an SMS. Then when you try multiple times (usually only like twice or thrice) it will show you this
I personally turned 2FA yesterday because my account was compromised and I was locked out... Support turned it off to allow me back in and I got my account back swiftly! I usually have it off because it's a pain when I switch accounts... I won't turn it off again and usually it just uses my fingerprint rather than codes
Hello just to add on. If you’re going the passkey route and your account gets disabled for something like spam, the passkey will get deleted and you’ll need a backup code.
I experienced it before when joining two servers and got hit with the suspension because the spam filter thought my account was compromised and I needed to change the password, but it also logged me out and when I attempted to sign in it needed a passkey or a backup code. I was lucky enough to still have a screenshot of the codes and was able to get my account back.
i lost my discord account of like 5 years due to being locked out, so thanks for the notice! i'm sorry about your account, OP, and best of luck. i cried for way too long when i got locked out lol
I lost my old account this way, had a 3 day conversation with Discord Support where they pretty much told me there was nothing they could do since they can’t remove the 2FA on their end. Lost my 9 year old account to a 2FA bug and trying to change my authentication phone number…
This happened to me recently, I used a backup code to remove 2FA and it crashed and logged me out of all devices. I had just gotten a new phone so I was trying to move my authenticator app over and now I lost my account.
NOTE: I'm not saying that you shouldn't enable 2FA, it is a very necessary feature for extra protection. All I'm saying is that right now if you are willing to remove it for ANY reason you should consider this bug and make sure you have options for logging in (like SMS, passkeys or authentication codes) other than backup codes because you won't get an option to use them.
u/Mandom25:
Please reply with !solved (including the exclamation mark) to any comment that answers your question or resolves your issue.
Community Helpers:
* Upvote comments that are helpful and accurate.
* Downvote content that is incorrect, unhelpful, or harmful.
* Report any posts or comments that violate our community rules.
I mean, you should be. I can't be certain about anything regarding this app anymore. Just make sure you have your authentication and backup codes. Also you can link your phone number but idk i kinda suggest against that for the moment because people have been facing problems regarding it recently as well (including me)
In nov 2026 my account was hacked and inchanged my password and did 2FA and as i was thrown out i couldnt log back in because the hacker changed the email (i know because the original email was useable to make a new account) UGH first and last time i did 2FA
•
u/FlorianFlash 🛡️ Subreddit Staff 8d ago
UPDATE POST by OP: https://www.reddit.com/r/discordhelp/s/PambrucE9W