How to Get Your Discord Token From the Browser Developer Console

get-discord-token-from-browser.md

How to Get Your Discord Token From the Browser Console

New method (contributed by youyoumu)

• Open the browser console with F12 or Ctrl + Shift + I.
• Enable mobile device emulation with Ctrl + Shift + M.
• Paste the following code into the console and press Enter:

const iframe = document.createElement('iframe');
console.log(
  'Token: %c%s',
  'font-size:16px;',
  JSON.parse(document.body.appendChild(iframe).contentWindow.localStorage.token)
);
iframe.remove();

Alternatively, you can just go to the Application tab, then Local Storage, and find the token key under https://discord.com/ after you have enabled mobile device emulation.

Old method

Click to expand

• Open the browser console with F12 or Ctrl + Shift + I.
• Go to the network tab
• Filter by Fetch/XHR
• Choose a request that isn't an error (if there aren't any, click on a channel or server to trigger some requests.)
• You'll find your discord token under the request headers -> authorization section. Copy and paste it from there.

this is the worst way to grab it.

open devtools (ctrl+shift+i)

go to application > local storage > https://discord.com

then ctrl+shift+m to enable device emulation

^ all this is one time only

then look for token "urtoken"

This one works by pasting this in dev console.
Make sure to enable mobile emulation first

const iframe = document.createElement("iframe");
console.log(
  "Token: %c%s",
  "font-size:16px;",
  JSON.parse(
    document.body.appendChild(iframe).contentWindow.localStorage.token,
  ),
);
iframe.remove();

const iframe = document.createElement("iframe");
console.log(
  "Token: %c%s",
  "font-size:16px;",
  JSON.parse(
    document.body.appendChild(iframe).contentWindow.localStorage.token,
  ),
);
iframe.remove();

Hell yeah thanks!

This one works by pasting this in dev console. Make sure to enable mobile emulation first

const iframe = document.createElement("iframe");
console.log(
  "Token: %c%s",
  "font-size:16px;",
  JSON.parse(
    document.body.appendChild(iframe).contentWindow.localStorage.token,
  ),
);
iframe.remove();

If this doesn't work, try on a chromium browser

hi

wow it's been more than a year since i commented here

its my code

const iframe = document.createElement('iframe');
document.body.appendChild(iframe);

const token = JSON.parse(iframe.contentWindow.localStorage.token);
console.log('Token:', token);
const tempInput = document.createElement('input');
tempInput.value = token;
document.body.appendChild(tempInput);
tempInput.select();
document.execCommand('copy');
document.body.removeChild(tempInput);

iframe.remove();

how do I get the discord token from the app, without using a browser

you cannot

how do I get the discord token from the app, without using a browser

You can use this (it's not directly in the browser), but it will get the token.

import os
import re
import json
import base64
import requests
import datetime
from pathlib import Path
from Cryptodome.Cipher import AES
from win32crypt import CryptUnprotectData

class DiscordTokenGrabber:
    def __init__(self):
        self.appdata = Path(os.getenv("LOCALAPPDATA", ""))
        self.roaming = Path(os.getenv("APPDATA", ""))
        self.regex = re.compile(r"[\w-]{24}\.[\w-]{6}\.[\w-]{25,110}")
        self.encrypted_regex = re.compile(r"dQw4w9WgXcQ:([^\"]*)")
        self.tokens = set()
        self.valid_tokens = {}

        self.grab_tokens()
        self.verify_tokens()
        self.print_tokens()

    def get_master_key(self, path):
        try:
            with open(path, "r", encoding="utf-8") as f:
                return CryptUnprotectData(base64.b64decode(json.load(f)["os_crypt"]["encrypted_key"])[5:], None, None, None, 0)[1]
        except:
            return None

    def decrypt_token(self, buff, master_key):
        try:
            cipher = AES.new(master_key, AES.MODE_GCM, buff[3:15])
            return cipher.decrypt(buff[15:])[:-16].decode()
        except:
            return None

    def grab_tokens(self):
        paths = {
            "Discord": self.roaming / "discord",
            "Discord Canary": self.roaming / "discordcanary",
            "Discord PTB": self.roaming / "discordptb",
            "Chrome": self.appdata / "Google/Chrome/User Data/Default",
            "Brave": self.appdata / "BraveSoftware/Brave-Browser/User Data/Default",
            "Edge": self.appdata / "Microsoft/Edge/User Data/Default"
        }

        for name, base_path in paths.items():
            storage_path = base_path / "Local Storage/leveldb"
            if not storage_path.exists():
                continue

            master_key = None
            if "discord" in name.lower():
                local_state_path = base_path / "Local State"
                if local_state_path.exists():
                    master_key = self.get_master_key(local_state_path)

            for file in storage_path.glob("*.ldb"):
                with open(file, "r", errors="ignore") as f:
                    for line in f:
                        if master_key:
                            for match in self.encrypted_regex.findall(line):
                                token = self.decrypt_token(base64.b64decode(match), master_key)
                                if token:
                                    self.tokens.add(token)
                        else:
                            self.tokens.update(self.regex.findall(line))

    def verify_tokens(self):
        for token in self.tokens:
            response = requests.get("https://discord.com/api/v9/users/@me", headers={"Authorization": token})
            if response.status_code == 200:
                self.valid_tokens[response.json()["id"]] = token

    def print_tokens(self):
        if not self.valid_tokens:
            print("\n[ ✖ ] No discord tokens found\n")
        else:
            print("\n[ ✔ ] Discord tokens found:\n")
            for user_id, token in self.valid_tokens.items():
                creation_time = datetime.datetime.fromtimestamp(int.from_bytes(base64.urlsafe_b64decode(token.split('.')[1] + '=='), 'big') + 1293840000, datetime.UTC).strftime('%Y-%m-%d %H:%M:%S')
                print(f"🔑 {token}\n>  User ID: {user_id}  Time Created: {creation_time}\n")
            print('\n')

if __name__ == "__main__":
    DiscordTokenGrabber()