Discord is safe enough for most adults to use every day, and unsafe in specific ways that are worth knowing before you hand over a photo ID or click a link from a stranger. The platform is large, around 200 million people use it each month, and it has had one significant data incident and a major policy change in the last twelve months.
This guide separates what Discord protects well, what it doesn't protect, and what you can change yourself. It covers encryption, the 2025 breach, age verification, scams and the settings that matter, with sources.
TL;DR
- Voice and video calls on Discord are end-to-end encrypted by default since March 2026, except Stage channels. Text messages are not, and Discord has no plans to change that.
- In October 2025, a customer-service vendor was breached and about 70,000 users may have had government ID photos exposed. Discord's own systems were not breached, according to Discord.
- The biggest day-to-day risks aren't technical. They're scam links, impersonation and what you share in public servers.
- Discord doesn't reveal your IP address to other users, but a link you click can. A VPN covers that one risk, and none of the others on this list.
- Parents can use Discord's Family Center and the safety settings. Teen accounts now have extra default protections.
Is Discord safe? The short answer
Safe means different things for different readers, so here is the answer by use.
| If you use Discord to | Safety level | Main thing to watch |
|---|---|---|
| Chat and play with friends | Good | Links and files from people you don't know |
| Join public servers | Moderate | Anything you post is visible to many people |
| Share sensitive information | Poor choice | Text isn't end-to-end encrypted |
| Verify your age with an ID | Weigh the risk | Government ID data was exposed in 2025 |
| Let a child use it | Depends on setup | Privacy settings and Family Center |
Discord's own privacy policy says it doesn't sell your personal information and that its business is funded by subscriptions, paid products and sponsored content. That's a meaningful difference from ad-driven platforms. It also says it collects technical information, including your IP address, which is normal for a service like this.
What Discord encrypts, and what it doesn't
This is the question that matters most for privacy, and the answer changed recently.
Voice and video: encrypted end to end. In September 2024, Discord introduced DAVE, an open protocol for end-to-end encrypting audio and video. On May 18, 2026, Discord announced that every voice and video call, in DMs, group DMs, voice channels and Go Live streams, is now end-to-end encrypted by default. Discord says the migration finished at the beginning of March 2026. Stage channels are the one exception, because they're built for broadcasting to large audiences. End-to-end encrypted means that Discord itself doesn't hold the keys to your call.
Text messages: not encrypted end to end. Discord's own wording is that messages "are not end-to-end encrypted" and that they follow its content moderation approach. In the May 2026 post, Discord says it has "no current plans" to extend end-to-end encryption to text. That means Discord can technically access the content of your messages, which is the basis for its safety tools and also a reason not to use Discord for anything you'd only tell one person.
In transit: encrypted. Like any modern service, the connection between your device and Discord is protected, so someone on the same Wi-Fi can't read it. This is separate from end-to-end encryption, which keeps the content from Discord too.
So Discord is a reasonable place to talk to friends and a poor place for secrets. Treat it like email: private from strangers, not private from the company.
The October 2025 data breach
In early October 2025, Discord disclosed that an unauthorized party had compromised one of its third-party customer service providers. In Discord's words, this was not a breach of Discord but of a third-party service, 5CA, which it used for customer support.
What Discord said was involved: messages with support agents, names and usernames, email addresses, IP addresses, limited billing information such as payment type and the last four digits of a card, and a small number of government ID images. What it said was not involved: passwords or authentication data, full credit card numbers, and messages or activity on Discord beyond what users had told support.
On October 9, 2025, Discord said roughly 70,000 users may have had government ID photos exposed, as reported by Ars Technica. Those were images users had provided to the vendor during age-related appeals. Discord said the numbers circulating online from the attackers were incorrect and part of an attempt to extort payment.
The lesson isn't that Discord is uniquely careless. It's that any ID you upload exists wherever the service sends it, and a vendor in the chain can be breached. If you can verify your age without uploading an ID, choose that option. We cover the options in Discord age verification: what changed and your choices.
Age verification and your data
In late September 2026, Discord began placing accounts into age groups. Discord's own announcement says most users won't be asked to confirm anything, and gives several ways to confirm if you are, some of which don't involve an ID. Read the details before you submit documents, because the 2025 breach involved exactly this kind of data. See Discord's post on the changes and our full breakdown of the rollout.
The real risks, ranked
Most Discord harm comes from people, not protocol flaws.
1. Scam and phishing links. Fake giveaways, "free Nitro" offers, fake support messages and links to login pages that imitate Discord are the most common route to account takeover. A stolen account is then used to message your friends, which is why these scams spread.
2. Impersonation. Someone copies a friend's name and picture and asks for money, a code or a click. If a friend suddenly asks for something unusual, confirm it somewhere other than Discord.
3. Public servers. Server owners set the rules, and anything you post in a large server can be seen by many people, including people you don't know. Discord's privacy policy warns of this directly.
4. Contact from strangers. Anyone in a shared server can try to message you unless you restrict it.
5. Your IP address, through links. Discord doesn't show other users your IP. If someone gets you to open a link they control, their server sees it. What Discord IP grabbers can and can't do covers this in detail, and what is Grabify explains the most common tool.
6. Teen safety. The ESRB's guide for parents points out that public servers are open to anyone, while private servers are limited to approved users. Teen accounts get extra default protections: message requests from non-friends go to a separate inbox, sensitive images are blurred, and age-restricted spaces are locked.
What Discord already protects well
- Link previews. When someone posts an image or video link, Discord fetches it through its own servers, so the site hosting it doesn't see your IP address, according to Discord's help center.
- Voice and video. End-to-end encrypted as above.
- Reporting and enforcement. Discord has a published Warning System, account standing page and appeals process.
- Passkeys. Discord supports passwordless sign-in with biometric passkeys.
Settings worth changing today
Open User Settings and check:
- Two-factor authentication. Turn it on. It's the biggest single protection against account takeover.
- Who can message you. Restrict direct messages from server members you don't know, under User Settings > Content & Social (older versions label this Privacy & Safety).
- Who can send friend requests. Limit it to friends of friends or people in shared servers if you don't want requests from anyone.
- Linked accounts. Remove connections you no longer use. Each one shares information.
- Active sessions. Review devices that are signed in and log out the ones you don't recognise.
Parents can add Discord's Family Center, which gives a summary of a teen's activity without exposing message content.
Where a VPN fits, and where it doesn't
A VPN is often sold as a fix for everything. For Discord it fixes one thing.
| Risk | Does a VPN help? |
|---|---|
| Data breach at a vendor | No |
| Phishing and scam links | No |
| Impersonation | No |
| Someone reading your text on Discord's side | No |
| Your IP exposed by a link you click | Yes, they see the VPN server's address instead |
| Hotel or café Wi-Fi snooping on connection metadata | Partly, Discord's traffic is already encrypted in transit |
| Your provider seeing you connect to Discord | Yes, it sees the VPN instead |
The honest summary: use two-factor authentication and caution with links first. Add a VPN if you often use shared networks or want your home address out of the picture when you click something. Atomic VPN does that part, and you can check what a site sees about you on our what is my IP page before and after connecting.
The bottom line
Discord is safe for ordinary chat and voice, unsafe as a place for secrets, and exactly as safe as your habits with links and account security. Turn on two-factor authentication, restrict who can message you and treat uploaded IDs as permanent.
A VPN will not stop scams, but it keeps your home address out of any link you open. $1.99 a month on the yearly plan, billed $23.99 once a year.
