How to get an EPP or authorisation code

An EPP code, also called an authorisation code or auth code, is a unique string your current registrar issues to prove you control a domain before it can be transferred to a different registrar. Without it, anyone could attempt to claim someone else's domain simply by asking a different registrar to take it over — the code is the check that stops that.

Where to find yours

Log in to the account where the domain is currently registered, open the management page for that specific domain, and look for a setting labelled something like "Transfer", "Authorisation code", or "EPP code". Some registrars display it immediately; others email it to the address on file for the domain's registrant contact, sometimes with a short delay built in as a security measure.

Before you request it

• The domain needs to be unlocked first. Most registrars will not release a usable EPP code, or the transfer will simply fail later, while the transfer lock is still switched on. See what a domain transfer lock is for how to turn it off.
• It needs to be at least 60 days since registration or the last transfer. This is an ICANN-wide rule for generic extensions like .com, .net, and .org, and a code requested too early will not let a transfer complete regardless of how valid it looks.
• The domain must not be expired. An expired domain generally needs renewing before a transfer can proceed at all.

What it looks like and how it is used

An EPP code is typically a short string of mixed letters, numbers, and symbols, unique to that domain at that moment — it is not a permanent password and is usually reissued each time one is requested. You enter it once, at the new registrar, when starting the transfer; see how to transfer a domain to a new registrar for the full process around it.

Not every extension uses one

The EPP system is standard for generic top-level extensions, but some country-code extensions use a different mechanism entirely for moving a domain between registrars. UK domains, for example, transfer using a registrar identifier called an IPS tag rather than an EPP code. If your domain is not on a generic extension, check with your registrar what their equivalent process actually requires before assuming an EPP code applies.