Exposed Discord Bot Token? Here's how to detect and rotate it

A Discord bot token is the single credential that authenticates your bot to Discord, and it carries every permission the bot has been granted. Anyone with the token controls your bot completely — there is no per-request check beyond the token itself. A leaked token means immediate, full bot takeover until you reset it.

What an attacker can do with a leaked Discord Bot Token

• Takes over your bot entirely and acts with all of its server permissions.
• Nukes servers — mass-deleting channels, banning or kicking every member.
• Spams every server the bot is in with scams, malware links, or raid content.
• Reads messages and server data the bot can see, exfiltrating private content.

How Discord Bot Tokens get exposed

• Committed to a public repo in a config, .env, or bot.py/index.js file.
• Hardcoded in a script or Dockerfile shared in a Discord, gist, or forum.
• Exposed in hosting logs, a screenshot, or a pasted error while asking for help.
• Detected by Discord's own scanning, which auto-resets tokens found leaked publicly.

How to rotate a leaked Discord Bot Token

1. Go to discord.com/developers/applications and open your application.
2. Click the Bot tab in the left sidebar.
3. Click Reset Token, confirm, and enter your 2FA code if prompted — the old token is invalidated instantly and any running instance disconnects.
4. Copy the new token once and store it in your environment or secrets manager, never in code.
5. Redeploy or restart your bot with the new token to bring it back online.
6. Open each server's Server Settings → Audit Log and review recent actions for bans, deletions, or role changes you did not make.

Open the Discord Bot Token dashboard →