Password-Protected Verification
Password protect your Discord server with RestoreCord: require a verification password, run several with limits and expiry, and keep the server invite only.
A verification password makes members type a password you choose before they can verify and get your verified role. Use one password for everyone, or several with their own limits, expiry dates and roles, so only the people you invite can get in.
How password-protected verification works
Discord has no server passwords of its own. Anyone with an invite link can join. RestoreCord locks the step that matters: verification. Until a member verifies, they don't get your verified role. If your channels are set up so that unverified members only see the verify channel, the rest of the server stays hidden until they enter the password. See Set Up Verification Channels to set that up.
Passwords live on the Passwords sub-tab of your server's Firewall tab. You can require them in two ways:
| Enforce Passwords | require password rule | |
|---|---|---|
| Who has to enter a password | Every member | Only members who match the rule |
| Which password works | Any active password | Only the one password you pick in the rule |
| Where to set it | Protections, on the Rules sub-tab | Add Security Rule › Custom Rule |
Both use the same passwords, and you can use both at once. The Firewall guide shows where the password check sits among the other checks.
Plan requirements
| Feature | Plan |
|---|---|
| Verification passwords and Enforce Passwords | Enterprise |
| require password rules | Enterprise, because the rule needs a password (custom rules themselves need Premium) |
| Private Server | Premium |
| Server membership rules | Business |
Without Enterprise, Add Verification Password is disabled and the menu on existing passwords is greyed out. Teammates you add as sub-users need the Manage Firewall permission to manage passwords. See Plans & Billing for prices.
Create a password
Open the Passwords sub-tab
On your server's Firewall tab, open Passwords and click Add Verification Password.
Fill in the details
| Field | What to enter |
|---|---|
| Password Label | A name only you see, such as “VIP Access” or “Staff Only”. Up to 50 characters, and different from your other labels. |
| Password | What members type. It is case-sensitive. |
| Max Uses (Optional) | Leave empty for unlimited. |
| Assigned Role (Optional) | A role given to members who verify with this password, on top of your verified role |
| Expires in (Optional) | A slider from 30 minutes up to 3 months, or No expiry (the default) |
Save it
Click Add Verification Password. The password appears in the list with an Active badge.
A password does nothing on its own. Next, turn on Enforce Passwords or use it in a require password rule.
Turn on Enforce Passwords
Enforce Passwords makes every member enter one of your passwords before they can verify. Find it under Protections at the top of the Rules sub-tab, or in the Add Security Rule picker, and click it to turn it on. It takes effect straight away. Turning it off asks you to confirm first.
Go to Firewall › Enforce Passwords
Create at least one active password before you turn this on. With no usable password, nobody can verify.
Once it is on, your verify page shows Enter Password instead of Verify.
Require a password for some members
To ask only certain people for a password, build a custom rule with the decision require password.
Choose who it applies to
Pick a field, an operator and a value, for example Country is a country you don't usually serve, or ASN is a network that brings you trouble. The Firewall Settings reference lists every field.
Pick the password
Set the decision to require password and choose the password under Required password. The password must be active, or the rule won't save. Optionally, use Add action to give up to 5 roles to members who pass.
How a require password rule behaves:
- A member the rule matches first goes through Discord as usual. They come back to the verify page with error 990032, and the password box opens by itself.
- Only the password chosen in the rule works. If they enter one of your other passwords instead, they see error 990031.
- Members who get in receive the rule's roles and the password's Assigned Role.
- If you disable or delete the password a rule uses, members that rule matches can't verify until you edit the rule and pick another password.
Rules are checked from oldest to newest and the first match decides. An allow through firewall rule that matches earlier lets the member skip a later require password rule, but it does not skip Enforce Passwords.
One password or several
You can create as many passwords as you need. With Enforce Passwords on, any active, unexpired password with uses left works. Each password keeps its own label, use count, limit, expiry and role.
Several passwords are useful when you want to:
- Give each group its own password, such as one per partner community, event or giveaway. The label shows in your logs, so you can see which one each member used.
- Give a role with the password. A “Staff” password with Assigned Role set to your staff role, next to a general password with no role.
- Retire one group's access without touching the others: disable just that password.
One password is simpler if you only need to keep strangers out. Labels must be unique, so give each password a name you'll recognise later.
Limit uses and set an expiry
- Max Uses: once a password's use count reaches its limit, the password stops working. The list shows the count as, for example,
Uses: 3/10, or just the count when there is no limit. - Expires in: the slider offers 30 minutes, 1, 6 or 12 hours, 1, 3 or 5 days, 1 to 4 weeks, 1 to 3 months, or No expiry. The list shows the expiry date.
- Disable Password turns a password off without deleting it. Enable Password turns it back on.
Expired, disabled and used-up passwords are rejected as wrong. To give a used-up password more room, use Edit Password and raise Max Uses; the use count is not reset.
Change or rotate a password
Edit Password changes the label, max uses, role and expiry, but not the password itself. To change what members type:
Create the new password
Add a new password with a new label. If you want the old role, pick the same Assigned Role.
Update your rules
If a require password rule uses the old password, edit the rule and pick the new one.
Share it, then retire the old one
Give members the new password, then disable or delete the old one from its ⋯ menu. Deleting asks you to confirm and cannot be undone.
To rotate on a schedule, give each password an expiry date and create the next one before it runs out.
What members see
Enter Password
With Enforce Passwords on, the verify page shows Enter Password. Clicking it opens Verification Password Required: “This server requires a password to verify. Please enter the password provided by the server administrators.”
Verify with Password
The member types the password and clicks Verify with Password. A wrong password shows “Invalid password. Please try again.” right there, before they go to Discord.
Authorize on Discord
A correct password sends them to Discord's authorize screen. If they take too long or switch networks before finishing, they are asked for the password again.
| What happened | What the member sees |
|---|---|
| No password was given | Error 990032: “Password required for verification. Enter the verification password below.” The password box opens. |
| The password stopped working before they finished, such as when it expired or was disabled | Error 990033: “Invalid verification password. Please check the password and try again.” |
| Too many wrong passwords | Password entry is locked for a while. The box shows “Too many failed attempts. Please try again in m:ss.” |
After the password, the member still goes through your other checks, such as captcha, alt detection and Minimum Account Age.
Who skips the password
- Members with an active bypass, granted with
/bypass grant, RC - Bypass or Grant Temporary Access. See Bypasses. - Members who match a bypass all checks rule, for example a rule on a staff member's User ID.
allow through firewall rules do not skip Enforce Passwords.
Track password use
| Where | What it shows |
|---|---|
| Passwords list | Each password's use count, limit and expiry date |
| Activity Logs | Password entries for members who got in with a password, with the password label. Invalid Password entries when a password was rejected after Discord. Use Filter by Event › Password to show only successful entries. |
| Summary bar on the Firewall tab | Password Used over the last 30 days |
| Analytics › Firewall | Password Used next to Allowed and Blocked, over longer periods |
| Discord webhook logs | Password Verified and Invalid Password Attempt messages |
| Custom webhook (Enterprise) | A firewall.password event with success set to true or false |
Go to Firewall › Activity Logs Go to Activity Logs › Filter by Event
Other ways to keep a server invite only
A password is the simplest way to let in only the people you invite. These options work instead of a password or alongside one.
Manage passwords with the API
With an API key that has the SERVER_FIREWALL permission, you can list, create, read, update, enable or disable, and delete passwords. See Firewall API › Passwords.
- Like the dashboard, the API can't change a password's value after it is created.
- Enforce Passwords can be turned on with Update Server, which needs
WRITE_SERVERS. - require password rules can be created with the rules endpoints.