Tool
Is this bot asking for too much?
Paste a bot's invite link or permission number. You'll see every permission it requests, how risky each one is, and what it could do if the bot were compromised.
Everything runs in your browser. Nothing you paste is sent anywhere.
Verdict
Broad
Several powerful permissions. Normal for moderation or setup bots, but make sure every one is used.
140123794496
0x20A0076C40
Critical risk
0
High risk
1
Medium risk
2
Low risk
8
Findings
Webhooks plus @everyone
Together these let a compromised bot create webhooks that mass-ping the server with any name and avatar, and keep doing it after the bot is kicked.
Only pinning?
If Manage Messages is only used to pin, request Pin Messages instead.
Use Application Commands is for members
Bots do not need it to register or answer slash commands. It controls whether members can use commands.
2 permissions affected by server 2FA
In servers that require 2FA for moderation, the bot owner's account needs 2FA enabled for Manage Messages, Manage Webhooks to work.
This looks like a moderation bot. Compared with our example, it also asks for Mention @everyone, @here, and All Roles, Manage Webhooks.
Compare with the example11 permissions requested
Lets the bot create, edit and delete webhooks. Used by bots that post with custom names and avatars.
If the token leaks: A leaked token can create webhooks that keep posting phishing messages under any name, even after the bot is removed.
Lets the bot delete other people's messages and remove their reactions. Used by moderation and auto-mod bots.
Lets the bot ping @everyone, @here and roles that are not normally mentionable.
Lets the bot add new reactions to messages, for example to seed a poll or a reaction-role menu.
Lets the bot see channels. Almost every bot needs this, and server owners can still hide specific channels with overwrites.
Lets the bot post messages. Note that replying to slash commands does not need this permission.
Lets links the bot posts show a preview, and is required for bots that send rich embeds.
Lets the bot fetch messages sent before it was looking. Needed to edit or react to older messages.
Lets the bot use emojis from its own servers, commonly used for branded buttons and reactions.
Controls whether members can use slash commands. Your bot does not need it to register or respond to commands; that is what the applications.commands scope is for.
Lets the bot send stickers from other servers.