Discord Token Decoder

A Discord bot token is three base64 segments joined by full stops. The first decodes to the bot's user ID. The second encodes the moment the token was issued, as seconds since the Discord epoch rather than the Unix epoch. The third is an HMAC that Discord verifies and that nothing outside Discord can derive or check.

Only the first two segments carry readable information, and neither is a secret - the bot's ID is public, and the issue time tells you nothing sensitive. The third segment is the entire security of the token, which is why a decoder can show you the ID and the date without needing any credentials.

The base64 here is URL-safe and unpadded, so decoders that assume standard base64 fail on tokens containing the characters that differ between the alphabets. That is the usual reason a token decodes correctly in one tool and not another.

A token is complete authentication. Anyone holding it can act as the bot everywhere the bot exists, with no password and no second factor. There is no way to revoke a specific use - the only remedy is regenerating the token in the Developer Portal, which invalidates the old one immediately.

Discord scans public GitHub repositories for tokens and automatically invalidates any it finds, which is a genuinely useful safety net but not one to rely on. A token committed to a private repository, pasted into a support channel or hardcoded in a distributed script is not covered.

The habit that prevents this is keeping the token in an environment variable and never in source. If you are debugging and need to paste something publicly, paste the decoded ID rather than the token.

A token has three parts separated by dots. The first part is a random identifier, the second is a base64-encoded JSON payload with the user ID and token metadata, and the third is a cryptographic signature. Only the middle part contains readable information.

A token acts as both username and password in one string. Anyone holding it can act as your account through the API. If a token ever leaks, revoke it immediately by changing your password, which invalidates the old token and issues a new one.