Is Extrator de token • Ace Bot safe?
Extrator de token • Ace Bot captures the user's Discord session token and displays it for hand-off to the third-party "Ace Bots" service.
The extension hooks Discord's network requests to read the Authorization header (the user's full Discord login token) from both outgoing requests and responses, and also pulls it directly out of Discord's own page code as a fallback. It actively forces a Discord API call in the background a few seconds after any Discord tab loads, guaranteeing a token is captured even if the user does nothing. The captured token is stored in the extension's local storage and shown in plaintext in the popup with a copy button, matching its stated purpose of obtaining a token to use with the third-party "Ace Bots" service named in the store listing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension captures your Discord session token and forces a request to get it
Code analysis shows this extension reads the Authorization header off every discord.com request, stores your full Discord session token in local storage, and shows it in the popup for you to copy into a third-party bot service.
You open or reload discord.com while logged in.
No click on the extension itself is required.
The extension reads the Authorization header off that request, then forces its own request two seconds later to guarantee one fires.
Both the background service worker and a page-level content script capture the header independently.
| Field | Value | Why it matters | |
|---|---|---|---|
Your Discord session token | MTA1MjM0NTY3ODkwMTIzNDU2.G1a2Bc.dEfGhIjKlMnOpQrStUvWxYz012345 | A full login credential. Anyone who has it can access your Discord account without your password or two-factor code. | |
Capture timestamp | 1758262845000 | When the token was captured, stored right alongside it. | |
Where it's kept | chrome.storage.local key 'discord_token'; localStorage key 'captured_discord_token' | The token sits in both the extension's own storage and the Discord page's browser storage, in plaintext. |
The capture logic, shipped source versus an annotated read of it
// Fires on every request to discord.com/api/* or *.discord.com/api/*
chrome.webRequest.onBeforeSendHeaders.addListener(
(details) => {
for (const header of details.requestHeaders ?? []) {
if (header.name.toLowerCase() === 'authorization' && header.value) {
// header.value IS the user's Discord session token
chrome.storage.local.set({
discord_token: header.value,
captured_at: Date.now(),
});
}
}
},
{ urls: ['*://discord.com/api/*', '*://*.discord.com/api/*'] },
['requestHeaders'],
);// Runs 2 seconds after any discord.com tab finishes loading
chrome.scripting.executeScript({
target: { tabId },
function: () => {
// This request's Authorization header is what the listener above captures
fetch('https://discord.com/api/v9/users/@me', { credentials: 'include' });
},
});// window.fetch is replaced; any call to discord.com/api/* is inspected
// for an Authorization header on the way out, and the response headers
// are checked for one on the way back
window.fetch = function (url, options) {
if (url.includes('discord.com/api') && options?.headers) {
const auth = options.headers['authorization'] ?? options.headers.get?.('authorization');
if (auth) storeToken(auth); // saved to localStorage as captured_discord_token
}
return originalFetch(url, options);
};// Discord's web client keeps a getToken() export inside its own webpack
// module registry. If no network request has fired yet, the extension
// walks that registry and calls getToken() itself.
if (window.webpackChunkdiscord_app) {
const req = window.webpackChunkdiscord_app.push([[Symbol()], {}, (r) => r]);
for (const id in req.c) {
const token = req.c[id].exports?.default?.getToken?.() ?? req.c[id].exports?.getToken?.();
if (token) storeToken(token);
}
}Checks this page's own local storage for a Discord token the extension has already captured, so you can see the capture for yourself without installing anything else.
// check-captured-token.js
// Run in the DevTools console on a discord.com tab to check whether
// this extension has written a captured token into page storage.
(function () {
const KEYS = ['captured_discord_token', 'token', 'auth', 'discord_token', 'user_token'];
let found = false;
for (const key of KEYS) {
const value = localStorage.getItem(key);
if (value && value !== 'undefined' && value !== 'null') {
console.log(`[CHECK] localStorage['${key}'] =`, value);
found = true;
}
}
if (!found) {
console.log('[CHECK] No captured token found in localStorage under the known keys.');
}
console.log('[CHECK] Note: chrome.storage.local (used by the extension\'s own background worker) is not readable from this page context; inspect it via chrome://extensions > Inspect views > background page.');
})();- 1Install the extension and log into discord.com.
- 2Open DevTools (F12) on the discord.com tab.
- 3Paste this into the Console and press Enter.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.