Is Discord Safe?

Discord is about as safe as the settings you pick and the servers you join. The defaults are better than they used to be, but they’re still not the safest setup available to you.

Ten minutes in the settings menu removes most of the risk you actually face. Here’s what to change, what to set up for a teen, and where the real trouble comes from.

Servers are where the risk lives

Discord isn’t one place. It’s millions of separate rooms, each with its own rules and its own moderators.

Those moderators are volunteers, not Discord staff. Discord runs platform-wide tools underneath — automated filters, image classifiers, PhotoDNA scanning for child abuse material. But the person deciding what’s allowed in a given chat usually has no training and no obligation to you.

Sharing a server also lets someone message you privately. A stranger in a 40,000-member gaming server doesn’t need to be your friend to land in your inbox. That link — public room to private DMs — is what’s most worth controlling.

Ten minutes of settings that do most of the work

Open User Settings and work through these.

• Turn on two-factor authentication. Nearly every “my Discord got hacked” story is a stolen password or login token, not a break-in at Discord.
• Change who can send you a friend request. Under Friend Requests you get Everyone, Friends of Friends, or Server Members. Everyone is the loosest.
• Stop server members from DMing you. “Allow direct messages from server members” is a per-server switch, on by default. Turn it off in a server’s privacy settings, or set it off by default for servers you join later.
• Check the DM spam filter under Content & Social. It filters messages from non-friends by default. You can also filter all direct messages, which is the quiet option.
• Set the sensitive media filters. There are two, one for sexual imagery and one for graphic violence, each set to show, blur, or block. For adults, images from non-friends are blocked already, but images from friends and in servers are shown. Move both to blur.
• Block instead of arguing. Blocked accounts can’t DM you, and their messages stay hidden in shared servers.

Every one of those defaults leans towards you being reachable. Discord is built for meeting people. You may not be.

Setting up a teen’s account

Discord’s minimum age is 13, and higher in some countries.

Enter the birthday correctly at signup. This is the load-bearing step and it’s awkward to fix later. Discord applies teen protections from that birthday, and an account marked 18+ can’t link to Family Center.

Since March 2026, teen-by-default settings have rolled out worldwide. Messages from unknown contacts go to a separate request inbox. Friend requests from unfamiliar accounts come with a warning. Sensitive images stay blurred unless the account is age-assured as an adult, and age-restricted channels need a verified adult.

Family Center is the parent-facing piece. A parent scans a QR code from the teen’s Family Center tab, and both sides have to agree. It then shows a seven-day summary: new friends, who the teen messaged or called, call minutes, servers joined, and purchases. It does not show message content. You see who, never what.

A parent can also set the content filters, friend request permissions, DM restrictions, a spending cap, and screen downtime — and once connected, the teen can’t change those themselves. The most useful part is the server list. Ask about any server you don’t recognise.

Grooming is the risk none of that covers, and it has a shape worth teaching. Someone friendly turns up in a public server. They want to talk privately, quickly. Then they want to move to another app, ask for photos, and keep it secret. The push off Discord is the tell.

Age checks, and what happened to the ID photos

Discord’s full global age assurance rollout has slipped to the second half of 2026. Checks are already live where the law requires them — the UK, Australia and Brazil, where rules took effect on 17 March 2026.

When you get asked, there’s usually a choice: facial age estimation that runs on your own device, an ID document, a credit card, or a model that infers age from account behaviour. Discord says over 90% of users will never see a prompt.

That choice matters. In October 2025, a third-party customer support vendor Discord used was compromised. The attacker took names, email addresses, the last four digits of payment cards, IP addresses, support conversations, and roughly 70,000 photos of government IDs people had sent in to appeal age checks.

Passwords, full card numbers and message content weren’t taken. But the weak spot wasn’t Discord itself — it was a supplier holding copies of sensitive documents. Where the on-device option exists, prefer it.

And Discord keeps plenty on its own: your messages, your IP address, and logs of which servers you visit.

The scams you’ll actually meet

• The free Nitro link is the most common. A message offers a subscription and points to a page that copies Discord’s login screen. Whatever you type there goes to whoever built it.
• Token grabbers skip your password entirely. They steal the file that keeps you logged in, so 2FA never gets a chance to help. They arrive as a download.
• The game-testing scam is the download you’ll be offered most. Someone asks you to try their indie game and sends a password-protected archive. Inside is an infostealer that takes saved passwords and crypto wallets.
• QR code logins are the newer trick. Only scan a Discord QR code you generated yourself, in the app. A code someone sends you logs them into your account.
• Fake moderators and fake Discord staff message people about “an issue with your account”. Discord doesn’t do support over DMs, and a real verification bot won’t send you off-site to log in.

Every one needs the same thing: a click, a download, or your password typed somewhere that isn’t Discord.

What a VPN does and doesn’t do here

Start with the limits, because they’re the bigger half.

A VPN doesn’t stop a scam DM arriving. It doesn’t make a phishing link safe, and it won’t undo a token grabber once you’ve run one. It can’t tell you a stranger is lying about their age. It changes no Discord setting and adds no parental control. It doesn’t change what Discord stores about you either — you’re logged in, so it knows who you are.

What it covers is the connection. On shared Wi-Fi — a hall of residence, a café, a hotel — your traffic runs through an encrypted tunnel, and whoever runs that network sees a VPN server rather than which services you’re using.

It also hides your real IP, which is worth explaining because Discord attracts a lot of nonsense about it. Discord relays voice through its own servers rather than connecting users directly, so nobody can pull your IP out of a call. “Discord IP resolvers” don’t work — they’re a myth left over from older peer-to-peer voice apps. What does work is an ordinary tracking link that logs everyone who clicks it, and those get passed around in DMs constantly. With a VPN on, that log records a server’s address instead of yours.

FAQ

Can someone get my IP address from Discord?

Not through Discord itself. Voice and video go through Discord’s servers rather than straight between users, so there’s nothing for a “resolver” to resolve. A tracking link does work, so avoid links from strangers — and a VPN puts a server’s address in that log instead of yours.

Do I have to give Discord my ID?

Most people never will — Discord says over 90% of users won’t see a verification prompt. It comes up if you open age-gated content, change certain safety settings, or live somewhere with an age-check law. Where you get a choice, on-device facial estimation keeps a document out of anyone’s hands.

Is Discord safe for a 13-year-old?

Thirteen is Discord’s minimum age, and teen accounts now get safer defaults automatically. Whether that’s enough depends on which servers they join. A private server with school friends is a different thing from a large public one, and it’s the public ones where grooming starts.

What should I do if my account is hacked?

Change your password from a device you trust, and switch on two-factor authentication if it was off. That ends other sessions and kills a stolen token. Then warn your friends — compromised accounts get used to send the same scam link to everyone on the list.

Does Discord read my direct messages?

Your DMs aren’t visible to other users, but they aren’t end-to-end encrypted either. They sit on Discord’s servers, and Discord can access them to handle a report or a legal request. Treat DMs as private from people, not private from the platform.

Cover the connection with Planet VPN

Your settings do the heavy lifting on Discord. A VPN covers what they can’t reach: the network between you and the app.

The free Planet VPN plan gives you 6 locations, no registration, no credit card. A short ad pays for it, and that’s the whole catch.

Premium starts at $1.99/month: 60+ locations across 1,260+ servers, up to 10 devices, split tunneling, Smart Filter to block ads and threats in your browser, Double VPN, gaming servers and a 30-day refund. Apps cover Windows, macOS, Linux, Android and iOS, plus browser extensions and routers.

Planet VPN keeps no activity logs. Only an email address is stored, and only if you subscribe.

Change your DM settings first. Then install it.