Discord does not have end-to-end encryption, and TOS forbids client-side modifications.

Discord collects a lot of data, and stores messages unencrypted.
This exposes conversations to the risk of abuse by companies abusing the data, malicious employees, hackers, and more.
Because of that, I do not believe Discord to be a safe platform to discuss private topics on.
Though it is likely unrealistic to entirely move away from Discord, I suggest educating community members about these risks and making safer spaces available to those who want them.
Plus, client mods like BetterDiscord and Powercord should be allowed.

Reasons not to use Discord: https://stallman.org/discord.html
A writeup on Discord's many risks: https://redd.it/ptz4zy

Some FOSS alternatives:

https://getsession.org (added by me)

  • Quite minimalistic but extremely private & secure messenger.
  • Uses the Oxen onion router (similar to Tor), so it doesn't have your IP, or for that matter, any information at all about you as it's decentralized.
  • No signup at all, account only needs private key (recovery phrase).

https://signal.org (added by me)

  • Signal is much like Session, as Session is a fork of Signal, but Signal uses your phone number to sign up, and is centralized rather than decentralized. However, as it's not onion routed, it's faster than Session. It's also slightly less minimalistic, though I haven't used it much so idk.
  • Along with Session, Signal is one of the least-metadata-logging messengers out there, only associating two pieces of information with your phone number: your account creation date and last connection date.
  • Signal's protocol is the foundation for many other messengers, like Session, Matrix, and even WhatsApp (though I wouldn't trust WhatsApp as it's owned by Meta [a.k.a. Facebook].)
  • Try Molly if you want to be super safe - it adds at-rest encryption for your mobile device (though you will have to enter in your password every so often when you open the app)

https://matrix.org

  • Very similar to Discord. Great for communities.
  • Far more secure than Discord because it has end-to-end encryption.
  • Decentralized, so you can never be banned, as you can just move to a different server, or even host your own one. Plus, if you host your own server, you have access to all of your data too (which, if you use encryption, is just metadata, not the actual contents of your messages).
  • has public and private chats, as well as simple voice calls that all support E2EE
  • has "bridges" - basically bots that send messages between Matrix and external services like Discord, which allows people from Discord participating in Matrix public chats and vice versa.
  • mod tools
  • many different clients; so everyone can get one that they like. The "official" client is called Element
  • their new feature called "Spaces" entered public beta a couple of months ago. It works a bit like a Discord server in that each Space contains rooms created by the Space admins, and is managed by them. However, Spaces can also contain other Spaces - making organization of topics and sub-topics/communities easier.
  • however

https://jitsi.org/

  • self-hosted, free, open source (but does have https://meet.jit.si/ a free public server)
  • video (group) calls with support for E2EE
  • can be directly integrated into a Matrix server to add video chats as a feature in Matrix

https://www.mumble.info/

  • self hosted, free, open source
  • low latency, high quality voice chat made for gaming
  • has Discord-like voice chat that is currently missing from Matrix (similar to TeamSpeak)
  • does currently not have E2EE, but the data that is stored by default is minimal and it's self-hosted, which still decreases the risk dramatically compared to Discord. Also you have to host your own private server as there isn't an official public server or anything, but that makes it more safe as well.
  • IMO much better sound quality than Discord
Some notes from the previous (reddit):

Discord collects a lot of data, and stores messages unencrypted.
This exposes conversations to the risk of abuse by companies abusing the data, malicious employees, hackers, and more.
Because of that, I do not believe Discord to be a safe platform to discuss extremely private (mental health) topics on.
Though it is likely unrealistic to entirely move away from Discord, I suggest educating community members about these risks and making safer spaces available to those who want them.

Discord collects a huge amount of data about every user. Every click, every channel opened, every game launched, every time you speak up in a voice channel [*]. Discord stores this data basically indefinitely [*].

Even when you disable the "usage statistics" option in the settings of Discord, Discord collects them anyway and simply promises to delete them as soon as they reach their server [*]. It goes without saying that there is no way for users to verify this.

When you delete your account, Discord will only set your name to "Deleted User". It will never delete any messages [*] and even ban you if you try to use a bot or script to delete the messages yourself. Since most people will share at the very least their name and some private details in some of their messages, this makes the "anonymization" of the data effectively useless.

Comment from me: The above is (arguably) a violation of Article 17 of the GDPR: Right to erasure (‘right to be forgotten’). Also, Undiscord takes days to delete your messages due to ratelimits, and is against TOS.

Discord does not use End-to-End-Encryption (E2EE)

This is the big one. Discord doesn't use any form of End-To-End-Encryption. This means that all messages sent by Discord are stored on their servers in a way that anyone with access to those servers can read them.

"Discord has your messages" might be an obvious statement to some, but E2EE is actually quite common nowadays. Messengers like WhatsApp, Facebook Messenger, Signal, and many more make use of it. It is used to secure all sorts of things in the tech world. When something has E2EE, the only ones who can read the messages you send are you and whoever you sent them to - an intermediary like WhatsApp can never read the messages themselves.

Malicious Employees

Since Discord doesn't use E2EE, anyone at the company who has access to the database containing these messages can read them. Unfortunately, employees of tech companies abusing their position to access private information is a common occurrence [*] [*] [*] [*] [*].
There is also no need to be targeted personally to fall victim to such an invasion: Practically all data storage formats that Discord could be using allow simply listening to keywords that the attacker might be interested in.
This danger is not one that Discord can ever entirely prevent without making it impossible for any employee to access the messages of its users - for example, by using E2EE.

Danger from the outside

The other big threat are hackers. Big social media companies are a very juicy target for hackers - and not even the biggest tech companies are able to reliably defend against their attacks. This leads to regular data breaches all over the tech world (just some examples: [*] [*] [*] [*] [*] and more... ).

Additional reading:

https://cadence.moe/blog/2020-06-06-why-you-shouldnt-trust-discord
https://www.youtube.com/watch?v=oHCK3NKFBW4
Terms of Service rated Grade E: https://tosdr.org/en/service/536
https://www.privacyguides.org/

Additionally, Discord is a mess on Linux because it uses an outdated version of Electron. This could be solved by allowing client mods.
https://www.youtube.com/watch?v=FnNpwVUwPag

Edit
Pub: 17 Oct 2022 05:03 UTC
Edit: 21 Oct 2023 03:47 UTC
Views: 482