Skip to content
MessagingFORENSICS

Glossary

Snowflake ID (Discord, Twitter/X)

A snowflake is a 64-bit identifier whose upper bits encode its creation time in milliseconds, used by Discord and Twitter/X for users, messages and channels.

Definition

A snowflake is a 64-bit, roughly time-ordered unique identifier. Twitter introduced the scheme in 2010, and Discord adopted it for every object: users, guilds, channels, messages and attachments. The layout used by Discord is:

bits 63–22  milliseconds since the platform epoch
bits 21–17  internal worker ID
bits 16–12  internal process ID
bits 11–0   per-process increment

Discord's epoch is 2015-01-01 00:00:00 UTC (1420070400000 ms). Twitter/X uses 1288834974657 ms (2010-11-04).

Extracting the time

unix_ms = (snowflake >> 22) + 1420070400000   // Discord

Because the value exceeds the range of a double, use 64-bit integer arithmetic (BigInt in JavaScript).

Forensic value

  • Every ID doubles as a creation timestamp, so an account ID tells you when the account was created and a message ID tells you when the message was sent, even when a record lacks a time field.
  • IDs are stable across renames, which makes them the correct key for linking a user across exports, screenshots and server logs.
  • Discord data packages name message folders after channel IDs (Messages/c<id>/), which dates each channel.

Pitfalls

The embedded time is the creation time of the object, not of later edits. Snowflakes pasted into spreadsheets lose precision in their last digits; keep them as text.