Set up Discord MFA and store backup codes before changing phones

Losing a phone is a poor time to discover that your Discord authenticator was the only route into the account. Discord supports several multi-factor methods, including an authenticator app, passkeys or security keys, and backup codes. The safest setup is not simply switching one on: it is registering methods you control, saving recovery codes outside the phone and testing the recovery path while you can still sign in. Discord Support says it cannot remove MFA for you if you lose all recovery methods.

Before you start​

Sign in on a device you trust and update Discord first. Secure the email address behind the account with its own unique password and MFA; email access can be central to recovery. Have an authenticator or supported security key ready, plus a secure place to store backup codes, such as a reputable password manager or a protected offline record. Never send codes to a friend, bot or purported Discord employee.

Do it step by step​

1. Open User Settings, then the account security or MFA section. Review which methods are already active. If an old phone or key is listed, do not remove it until a replacement method has been added and verified.
2. Add a passkey or security key if your device supports it, or set up an authenticator app using Discord's current on-screen flow. The QR setup code is a secret: scan it only into your own authenticator and never share a screenshot of it.
3. Finish enrollment by entering the requested verification code. Return to the settings page and confirm the method appears as enabled. A code merely appearing in the authenticator does not prove Discord accepted enrollment.
4. Generate or view Discord backup codes and store them in a separate secure place you can reach without the phone being replaced. Treat each code like a password, note that a code may be single-use, and refresh your saved copy if you regenerate the set.
5. If you are about to change phones, transfer or re-enroll the authenticator through its supported process while the old phone is still available. Add the new method, sign out of a harmless secondary session, and test a normal sign-in before wiping the old device.
6. Review the list again for a method you no longer control. Remove it only after the new sign-in path and backup-code access have been proven. Check email and password security at the same time so MFA is not protecting an otherwise exposed account.

Check the result​

At least one current MFA method works in a fresh sign-in, your backup codes are readable from a safe location independent of the phone, and obsolete methods are gone. You can identify which method you would use if the primary device disappeared tonight.

If something goes wrong​

If the app reports a wrong one-time code, check the device clock and select the correct Discord account in the authenticator; do not repeatedly delete and re-add the method. If you are already locked out, use an unused backup code or another enrolled method. Discord warns that Support cannot simply turn MFA off when every recovery method is lost.

Know the limit​

MFA reduces account-takeover risk but does not protect an already logged-in session that you approve for an attacker. Backup codes are not a universal bypass for every sensitive action, and SMS has phone-number takeover risks. Recovery is strongest when methods are independent and tested, not when every factor lives only on one phone. Discord MFA setup and recovery