ShowHiddenChannels is one of the most popular Discord client plugins. It exposes channels you were never meant to notice. Locked staff rooms, hidden categories, and internal announcement channels suddenly appear. The important detail is that nothing is being hacked. Discord already provides the data.
The Big Secret: The Channels Are Already There
The entire plugin exists because of a single architectural decision. Discord sends metadata for every channel in a server to the client, even if the user does not have permission to view them.
The client does not request channels on demand. When you connect to a guild, Discord sends a full snapshot over the Gateway connection. Permission checks happen locally afterward and decide what gets rendered.
This is why ShowHiddenChannels works without touching Discord's servers. The data is already present in memory. The plugin simply prevents the UI from hiding it.
The Permission Override
Everything hinges on a single permission check. If the client believes you can view a channel, it renders it.
if (permission === DiscordConstants.Permissions.VIEW_CHANNEL) {
return (
!this.settings.blacklistedGuilds[channel.guild_id] &&
this.settings.channels[
DiscordConstants.ChannelTypes[channel.type]
]
);
}What Gets Patched in Practice
The plugin patches ChannelPermissionStore.can using BetterDiscord's patcher. This function is called constantly by the client whenever it needs to know whether a permission applies to a channel.
When VIEW_CHANNEL is checked on a hidden channel, the plugin returns true based on user settings. Discord trusts the result and renders the channel immediately.
Why the Lockscreen Exists
Once a hidden channel becomes visible, Discord still enforces real permissions for messages. Fetching messages is explicitly blocked in the plugin, and message requests are never sent.
Instead of showing an empty chat, ShowHiddenChannels replaces the view with a lockscreen component. This is injected at the routing layer and only activates when navigating to a hidden channel.
The lockscreen is built entirely from existing channel data. It can show the channel type, topic, slowmode, NSFW flag, bitrate, creation date, last message timestamp, icon emoji, and even permission overwrites when enabled.
No protected endpoints are queried. Everything comes from the channel object Discord already sent.
Why Discord Designed It This Way
- Simpler architecture: Sending all channel data at once avoids complex permission diffing and constant resyncs.
- Performance: Client-side permission checks are far faster than validating visibility on every request.
The Takeaway
ShowHiddenChannels does not break Discord security. It exposes the risks of trusting the client with data it should never receive. If information is sent to the client, it can be surfaced.
Final Thoughts
This is a lesson in client-server architecture, not an endorsement of client modification. Discord still enforces permissions where it matters, but UI-level trust always comes with tradeoffs.
Explore the source code on GitHub.