Code blocks with syntax highlighting, spoilers, custom emoji, links — rendered by Discord's own parser once decrypted. It reads like a normal message, in green.
01 / HOW IT WORKS
One button. One phrase. Nothing else to manage.
The key derives from your phrase and the channel itself, so the same phrase in the same channel always produces the same key — for everyone, on any machine, forever. No key files, no QR codes, no exchange protocol.
/01
Click the 🦇 in the chat bar
Open any channel, group, or DM. The bat button sits next to the message box and asks for exactly one thing.
/02
Set a secret phrase
Make it long and unique — it's the entire protection. From that moment everything you send goes out encrypted, automatically.
/03
Tell your people the phrase
Share it outside Discord. They click the same 🦇, type the same phrase, and every message decrypts — past and future.
🦇
GreyNot encrypted. Click to set a phrase.
🦇
GreenEncrypted. Everything sends as ciphertext.
🦇
AmberLocked. Enter the phrase to unlock.
🦇
RedBroken by a Discord update. Sending is blocked, never leaked.
02 / COVERAGE
Everything encrypts. Discord still feels like Discord.
Full markdown, after decrypt
Encrypted files & media
Images, video, audio, any file — uploaded as opaque .bpenc blobs with the real filename sealed inside. Key holders see inline previews; everyone else sees noise.
Nothing to back up
Keys are derived, never stored. Wipe the plugin, switch machines, come back a year later — type the phrase and everything comes back.
Auto-locking sessions
Keys live in memory only and re-lock after inactivity. Ctrl+Shift+L locks everything instantly; optional lockdown mode re-locks on every channel switch.
Per-channel control
Each channel has its own key and its own on/off switch. /pt sends a single message in plaintext; /enc picks a specific key. Power features stay in Settings.
Fails closed, never open
If a Discord update breaks message interception, the plugin blocks sending instead of silently leaking plaintext — the 🦇 turns red and says exactly what's wrong.
Long messages split themselves
Discord caps messages at 2000 characters and ciphertext is bulkier than text. Write as long as you like — BetterPrivacy encrypts the message in parts and sends them in order, each one a complete encrypted message on its own.
Readable without the plugin
Every encrypted message is a 🦇 link. Anyone can click it, type the phrase, and read it in their browser — messages and .bpenc files alike. Nothing is uploaded; the decryption happens in the tab.
data breach → ciphertext · scanning bot → ciphertext · subpoena → ciphertext
Discord can't reveal what it can't see.
click the 🦇 — or hover the redaction — to decrypt
03 / SECURITY, HONESTLY
Clear about what it does — and what it doesn't.
The model is simple — Discord can't read what it never receives. Here are its exact edges: passphrase-based symmetric encryption with standard primitives, AES-256-GCM via WebCrypto, PBKDF2-HMAC-SHA256 at 600,000 rounds, reviewed adversarially before release.
What it protects
- Message and file contents. Discord's servers, data breaches, and subpoenas get ciphertext only.
- Against network observers. ISPs and WiFi snoops see authenticated AES-256-GCM blobs.
- Against non-recipients. Anyone in the channel without the phrase sees unreadable ciphertext.
- Attachment names. Files upload as randomly-named
.bpenc; the real name is inside the encryption. - Against tampering. A modified message fails loudly instead of decrypting to something wrong.
What it doesn't
- Metadata. Who talks to whom, when, and how much stays visible — as does the fact that you encrypt.
- Weak phrases. The phrase is the entire defense. Short or reused phrases can be guessed.
- No forward secrecy. A leaked phrase exposes past and future messages encrypted with it.
- Your own device. Malware, or anyone at your unlocked keyboard, sees what you see.
- Voice and video calls. Out of scope — chat messages and file attachments only.
Discord ToS warning. BetterPrivacy runs on BetterDiscord, and modifying the Discord
client violates Discord's Terms of Service — accounts can be suspended or banned. This project
is for educational and personal use. Don't run it on an account you can't afford to lose.
04 / INSTALL
Two minutes, four steps.
- Install BetterDiscord — desktop only: Windows, macOS, or Linux.
-
Download BetterPrivacy.plugin.js and drop it into your plugins folder:
Windows
%APPDATA%\BetterDiscord\plugins\macOS~/Library/Application Support/BetterDiscord/plugins/Linux~/.config/BetterDiscord/plugins/ - In Discord, open Settings → BetterDiscord → Plugins and switch BetterPrivacy on.
- Open a channel, click the 🦇, set a phrase. You're encrypted.
05 / FAQ
Questions people actually ask.
What do people without the plugin see?
A 🦇 followed by a link to this site. Clicking it opens the decrypt page: the scrambled payload rides in the URL fragment — which browsers never send to any server — and the secret phrase unlocks it right in the browser. The same page also opens encrypted .bpenc attachments — drop the file in and type the phrase. Every encrypted message is both unreadable and a signpost to the plugin.
Can I send messages longer than Discord's limit?
Yes. Encryption inflates text, so a long message wouldn't fit Discord's 2000-character cap as one ciphertext. BetterPrivacy splits it automatically — up to twelve encrypted parts, sent in order, each independently decryptable. You just type and press enter.
Do I need an account or a server?
No. There is no backend, no signup, no telemetry. Every cryptographic operation happens inside your Discord client via the WebCrypto API. This website is just a download page.
What if I forget my phrase?
It's gone — by design. The plugin never stores the phrase or any way to recover it. Anyone else who knows the phrase effectively holds the backup, since typing it in the same channel always recreates the key.
How do keys survive reinstalling the plugin?
Keys are derived deterministically — PBKDF2 over your phrase, salted by the channel. The phrase plus the channel is the key. Reinstall, switch machines, type the phrase again, and everything decrypts.
Can I send one unencrypted message without switching encryption off?
Yes — prefix it with /pt and that single message goes out in plaintext. There's also /enc <label> <message> to encrypt with a specific key.
Does it work on mobile?
No. BetterDiscord is a desktop client mod, so BetterPrivacy is desktop-only. Messages received on mobile stay ciphertext and decrypt once you're back at your desk.
Is this against Discord's Terms of Service?
Yes — all client modification is, including BetterDiscord itself. Accounts can be suspended or banned. Weigh that risk before using it on an account that matters to you.
Why should I trust the crypto?
Standard primitives, no inventions: AES-256-GCM via WebCrypto, PBKDF2-HMAC-SHA256 key derivation, authenticated chunked file encryption. The wire format is open, and the code went through adversarial security review before release.