Discord bot token leaked? Reset it and keep it safe

Updated 4 November 2026

If your Discord bot token has leaked, reset it right away in the Discord Developer Portal (your application → Bot → Reset Token), put the new token in your .env file and restart the bot. The old token stops working the moment you reset it, so whoever has it can no longer control your bot.

Checked on 29 October 2026: GitHub lists the Discord bot token (discord_bot_token) among the secret types its secret scanning detects, and Discord has been a GitHub token scanning partner since 2019, which means a token pushed to a public repository is reported to Discord.

Signs your token has leaked

• Your bot suddenly shows "An invalid token was provided" (discord.js) or "Improper token has been passed" (discord.py), while you didn't change anything. A token found in a public place can be reset for you.
• Your bot posts messages, sends DMs or bans people that you didn't program.
• You pushed your code to a public GitHub repository, pasted it in a help channel or shared a screenshot with the token visible.

Fix it in 5 minutes

1. Open the Discord Developer Portal, choose your application and go to Bot.
2. Click Reset Token, confirm, and copy the new token. You only see it once.
3. In SparkPanel, open Files, open .env and replace the old value: DISCORD_TOKEN=your-new-token. Save.
4. Restart your bot and check the console: it should log in again.
5. Check your Discord servers for damage: the audit log (Server Settings → Audit Log) shows what the bot did.
6. Remove the token from wherever it leaked (see below). Resetting is what makes you safe; removing it is cleanup.

Keep the token out of your code

The token belongs in a .env file, never in index.js, app.py or a config file you commit.

1. Create .env with one line: DISCORD_TOKEN=your-token.
2. Read it in your code: process.env.DISCORD_TOKEN with the dotenv package (Node.js) or os.getenv("DISCORD_TOKEN") with python-dotenv (Python).
3. Create a .gitignore file next to it containing the line .env, before your first commit. Git then never uploads it.
4. Put a .env.example with DISCORD_TOKEN= (no value) in your repository, so others know which variables your bot needs.

New bot servers at ServerSpark already come with a working starter bot that reads its token from .env; see Run your Discord bot 24/7.

Already committed it?

Deleting the file in a new commit is not enough: the token stays in your Git history, and anyone can still find it there. So:

• Always reset the token first. After a reset, the old one in your history is worthless.
• Then add .env to .gitignore and remove it from Git with git rm --cached .env.
• Want the history clean too? Rewrite it with a tool such as git-filter-repo, or for a small project, make a new repository without the token. Make the repository private if it doesn't need to be public.

Other places tokens leak

• Screenshots and screen sharing of your code or the Developer Portal.
• Help channels and pastebins: remove the token before you paste code.
• Free hosts and online editors where your project is public by default. Check the visibility settings, or see Replit, Render or Railway for a Discord bot?
• Logging: never print the token in your console output.

Bot offline for another reason?

A wrong token is one of eight common causes; intents, crashes and memory are others. See Discord bot offline? 8 causes and how to fix them. Running your bot with us costs €0.69 per month paid per quarter (€0.79 monthly billing, 512 MB RAM); see Discord bot hosting.

Frequently asked questions