What it means
A Discord login QR code appears on a desktop or browser sign-in screen and is scanned by the signed-in Discord mobile account. Approving it grants a session to that desktop or browser. A server-invite QR represents a link to join or preview a community; it does not by itself need account-login approval. Both can be visually similar to ordinary camera users, so the secure question is what the resulting app screen requests you to authorize.
A real-world example
A fake giveaway account sends an image and asks a member to scan it to verify eligibility. The scan opens Discord's Log in or Cancel confirmation. That is an account-access decision for the sender's waiting browser, not verification for a prize.
What to do
If you did not create the login attempt on your own computer, tap Cancel. Generate login codes only on devices you control and inspect the approval screen. If you mistakenly approved, change your password promptly; Discord says this logs out all devices.
The distinction that matters
The QR code's two-minute expiry is a time limit, not evidence of legitimacy. Scanning and approving are separate actions, so an accidental scan can still be stopped at Cancel. Do not mistake a known user's message for a trusted login request: their account may have been stolen too. A genuine server invitation should show the expected community and joining choice, while a login approval should never be needed to claim a giveaway, pass a moderator check or view a message.
Discord QR login safety
