nullcipher

Discord bot tokens (user ID . timestamp . HMAC)

Three dot-separated base64 parts: the bot's numeric user ID, a 6-character timestamp and an HMAC. The first part must decode to a 17-20 digit Discord ID. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Discord bot token

What an AI chat would receive after masking

# EXAMPLE, not a real bot token
Authorization: Bot [DISCORD_BOT_TOKEN_1]

1 × Discord bot token found and masked.

How nullcipher recognises it

Three dot-separated base64url parts: the bot's numeric user ID in base64 (24 to 27 characters starting with M, N or O), a 6-character timestamp, and a 27 to 38 character HMAC. The first part must decode to a 17 to 20 digit Discord ID, so random dotted strings are left alone.

This is the rule text of the “Discord bot token” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

The same page covers 3 more rules, each with its own placeholder:

Discord API token — [DISCORD_API_TOKEN_1]
Checked only when the text contains “discord” (any case). Pattern (gitleaks rule discord-api-token, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Dd][Ii][Ss][Cc][Oo][Rr][Dd])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([0-9A-Fa-f]{64})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. (gitleaks rule)
Discord client secret — [DISCORD_CLIENT_SECRET_1]
Checked only when the text contains “discord” (any case). Pattern (gitleaks rule discord-client-secret, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Dd][Ii][Ss][Cc][Oo][Rr][Dd])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([\-0-9=A-Z_a-z]{32})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)
Discord client ID — [DISCORD_CLIENT_ID_1]
Checked only when the text contains “discord” (any case). Pattern (gitleaks rule discord-client-id, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Dd][Ii][Ss][Cc][Oo][Rr][Dd])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([0-9]{18})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)

Example (fake)

# EXAMPLE, not a real bot token
Authorization: Bot MTIzNDU2Nzg5MDEyMzQ1Njc4.GExmpl.EXAMPLE_not_a_real_bot_token_EXAMPLE

nullcipher replaces it with [DISCORD_BOT_TOKEN_1]. Built to the shape of the example in Discord's API reference, in the Authorization: Bot header format it documents. The first part, MTIzNDU2Nzg5MDEyMzQ1Njc4, is base64 for the made-up user ID 123456789012345678 — decoding it to a number is how nullcipher tells a bot token from any other dotted string. The HMAC part spells EXAMPLE; Discord never issued it.

Why it matters in an AI chat

Discord's reference authenticates a bot with the header Authorization: Bot followed by the token. Discord describes bot users as having full access to most API routes without bearer tokens, plus the real-time Gateway, so a leaked token lets someone run your bot: read what it can read in every server it is in, post as it, and use whatever moderation permissions it holds.

Discord's getting-started guide calls the token highly sensitive and says you cannot view it again after creation — you can only reset it.

The first part is not secret on its own: it is just the bot's user ID in base64. nullcipher uses that to check the token without needing the word discord nearby. The gitleaks rules also shown below catch other Discord credentials — a client secret or a 64-hex-digit key — only when a key name containing discord sits right before them.

If it already leaked

  1. Reset the token: in the Developer Portal open your app, go to the Bot page and click Reset Token under Token. The new token replaces the old one, and you will not be able to view it again, so copy it straight into your secret store. [1]
  2. Update the bot's configuration (.env or secret manager) with the new token and restart it; the old token no longer authenticates. [1]
  3. Look through the servers your bot is in for messages or moderation actions you did not make while the token was exposed.

Sources

  1. Getting started — Discord Developer Docs — checked 2026-09-25.
  2. API reference: authentication — Discord Developer Docs — checked 2026-09-25.
  3. OAuth2: bot users — Discord Developer Docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.