Vorla
Get Launcher

Discord Role Audit

Paste your roles and see which ones hold Administrator, which can ban, kick or delete channels, and what each one can actually do.

Name first, permission integer last. Decimal or hex, commas, colons and tabs all work.

Paste a role list and every role lands here, ranked worst first, with the permissions that earned it that rank.

The 12 permissions the audit flags

Eleven are the set Discord gates behind server-wide two-factor authentication. The twelfth reaches every member at once.

PermissionVerdictAPI flagBitDecimalWhat it lets someone do
AdministratorCriticalADMINISTRATOR1 << 38Every permission + bypasses all channel overwrites
Manage ChannelsHighMANAGE_CHANNELS1 << 416Create, edit and delete channels
Manage RolesHighMANAGE_ROLES1 << 28268435456Create, edit and delete roles below their own
Manage ExpressionsHighMANAGE_GUILD_EXPRESSIONS1 << 301073741824Edit and delete emoji, stickers and soundboard sounds
Manage WebhooksHighMANAGE_WEBHOOKS1 << 29536870912Create, edit and delete webhooks
Manage ServerHighMANAGE_GUILD1 << 532Edit server name, region and other settings
View Monetization AnalyticsHighVIEW_CREATOR_MONETIZATION_ANALYTICS1 << 412199023255552View role-subscription insights
Kick MembersHighKICK_MEMBERS1 << 12Remove members from the server
Ban MembersHighBAN_MEMBERS1 << 24Ban members from the server
Manage MessagesHighMANAGE_MESSAGES1 << 138192Delete other users’ messages
Manage ThreadsHighMANAGE_THREADS1 << 3417179869184Delete, archive and manage threads
Mention @everyone, @here & RolesElevatedMENTION_EVERYONE1 << 17131072Ping @everyone, @here and all roles

How the audit works

How to use it

  1. Get your roles with their permission integers, either as the JSON from GET /guilds/{guild.id}/roles or as one role per line with the number last.
  2. Paste them in. The audit runs as you type and nothing is sent anywhere.
  3. Read the ranked list. A role’s verdict is its single worst permission, so the roles that can actually hurt you sit at the top.
  4. Use Who holds what to answer the question the Discord UI makes you click through every role for: who can ban, who can delete channels, who can ping everyone.

What the tiers mean

Nothing here is a judgement call. Critical is Administrator, which grants every permission and bypasses all channel overwrites. High is the set Discord itself gates behind server-wide two-factor authentication, which is Discord’s own definition of moderation-grade. Elevated is Mention Everyone, the one remaining flag that reaches every member at once. Everything else is Low.

Bits above 31 are handled with BigInt, so the newest permissions, from Set Voice Channel Status at 1 << 48 to Bypass Slowmode at 1 << 52, decode exactly. A bit the Discord API docs do not assign is reported and then ignored rather than folded into a verdict.

FAQ

Where do I get a role list to paste?

Any bot or dashboard that can read your server prints role names with their permission integers. If you use the Discord API directly, GET /guilds/{guild.id}/roles returns the whole list as JSON, and you can paste that payload here unchanged. One role per line, name first and the number last, also works.

What makes a permission dangerous?

The audit flags the eleven permissions Discord itself gates behind server-wide two-factor authentication, plus Mention Everyone. Administrator counts on its own: it grants every permission and ignores channel overwrites, so no other setting can take it back.

Why is a role with fifty permissions ranked below one with three?

A verdict is the single worst permission a role holds, not the total. Fifty harmless flags are still harmless. Three that include Ban Members are not.

Does this show the permissions someone actually has?

It shows what each role grants at server level. A member gets the union of their roles, and channel-level overwrites can add or remove permissions per channel, except for Administrator, which ignores them.

Is my server data uploaded anywhere?

No. The permission table and all the math live in this page. Nothing you paste leaves your browser, and there is no bot to invite and no login.