Domains and WHOIS

What is an EPP code (auth code) and how do I get one?

Unlocking a domain says you are willing to let it go. The EPP code says you are the person entitled to do it, which is why every transfer asks for one.

An EPP code, also called an auth code, authorisation code or transfer key, is a secret string attached to a domain at the registry. The registrar you want to move the domain to submits it, and if it matches the one on file the registry accepts the transfer as authorised by the owner. You get it from your current registrar, usually from the domain’s settings page after you have switched the transfer lock off, and for generic TLDs the registrar must supply it within five calendar days of your request. Treat it like a password: anyone who has it and an unlocked domain can move the domain.

Worked out 2026-10-16 (IST) · generic TLDs (.com, .net, .org and similar) under the ICANN Transfer Policy; country-code TLDs set their own rules

What the code does in a transfer

Where the EPP code fits
Step	Who acts	Role of the code
Unlock the domain	You, at the current registrar	None yet - removes clientTransferProhibited
Request the code	You, at the current registrar	The registrar generates or reveals the string
Start the transfer	You, at the new registrar	You paste the code in; the new registrar sends it to the registry
Registry check	The registry (Verisign for .com)	Compares the submitted code with the one it holds; mismatch = rejected
Completion	Registry and both registrars	The code is consumed or reset so it cannot be reused

The full sequence, including the confirmation email and the usual delays, is on how to transfer a domain to another registrar. The lock that has to come off first is explained in domain status codes explained.

Why it is treated as a password

A transfer moves control of the name, and with it the website address, every email address on the domain and the ability to reissue certificates. Domain hijacking usually starts with an attacker who has the registrar login obtaining the auth code and moving the name to a registrar they control. That is why the code should be requested only when you are ready to transfer, never pasted into a support chat or a shared document, and why the domain should be re-locked if the transfer is abandoned.

Old model, new model

Permanent auth code versus TAC
Property	Older practice	Revised design (TAC)
When it exists	Often created at registration and sits on the account	Generated only when you request it
Lifetime	Frequently no expiry	14 days (336 hours) at the registry, single use
Storage at the registry	Sometimes readable by the registrar later	Held only as a one-way hash
Strength	Whatever the registrar chose	Random, with a published entropy floor (RFC 9154)
Delivery deadline	Five calendar days	Restated as 120 hours

Two details of the wider policy revision are worth knowing but should be checked with your registrar, because implementation dates differ: the post-registration and post-transfer lock is being shortened from 60 days to 30, and the separate confirmation step at the losing registrar is being removed so that a transfer begins when the code holder submits it. Until your registrar says it has switched over, assume the 60-day figures in the transfer guide still apply.

If the code is rejected

Troubleshooting a code that does not work
Symptom	Likely cause	Fix
"Invalid authorisation code"	Extra space or a missing character when pasting	Copy it again; some codes contain symbols such as * and @
Worked yesterday, fails today	The code has expired or been reset	Request a new one
Code never arrives	Sent to an old registrant email address	Fix the contact email, accepting that this can start a lock
"Domain not eligible"	Inside a 60-day lock, or still locked	Wait out the lock or remove clientTransferProhibited

You can confirm the lock state without logging in anywhere: a WHOIS lookup lists every status code on the domain, and a domain showing clientTransferProhibited will not move whatever code you supply. People who let a domain lapse should also read what happens when a domain expires, because a code cannot be issued once a domain has gone into the redemption period.

Sources: IETF RFC 5730 and RFC 5731 (EPP and the EPP domain mapping, where the authorisation information is defined), RFC 9154 (secure authorisation information for transfer), and the ICANN Transfer Policy for generic TLDs, whose revision is being implemented by registrars individually.

Check your own numbers

Check whether the domain is still locked, and which registrar holds it today.

WHOIS LookupRegistrar, dates, name servers and status codes for any domain.

Frequently asked

What does EPP stand for?

Extensible Provisioning Protocol, the standard (IETF RFC 5730) that registrars use to talk to a registry when they create, renew, update or transfer a domain. The "EPP code" is simply the authorisation information field that protocol defines for a domain, which is why the same string is also called an auth code or AuthInfo.

Why does my registrar not show an EPP code?

Three common reasons. The domain is still locked, and many dashboards hide the code until you unlock it. The domain is inside a 60-day lock after registration, a transfer or a contact change. Or the registrar emails the code to the registrant address instead of displaying it. A registrar may not refuse to release it because of a commercial dispute, and ICANN Contractual Compliance takes complaints about generic TLDs.

Does an EPP code expire?

Historically many did not, which is part of why they were a risk. Under the revised generic-TLD design the code is generated only when you ask, is single-use, and lapses after 14 days (336 hours) if not used. Registrars are adopting the change one by one, so if the code you were given does not work, request a fresh one rather than assuming a mistake.

Is the EPP code the same for .in, .uk or .de domains?

The idea is the same, the details are not. Country-code registries set their own rules. As examples, .uk uses a "tag" change rather than a code, .de uses an AuthInfo with its own length and lifetime, and .in follows NIXI’s process. Always check the registrar’s page for the specific extension.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.