Domain Auth Code (EPP Code): How to Get One and Transfer Your Domain

A domain auth code, also called an EPP code or a Transfer Authorization Code (TAC), is the password that proves you have the right to move a domain to another registrar. You get it from the registrar that currently holds the name, usually in one click from the domain's settings page, after you unlock the domain. You then hand it to the gaining registrar, they request the transfer, and the name moves. The code is the only piece most buyers get stuck on, and the fix is almost always "unlock the domain first."

What is a domain auth code?

A domain auth code is a unique string of characters, typically 8 to 32 letters, numbers, and symbols, that authorizes a registrar transfer. It exists so nobody can move your domain out from under you just by knowing your email address. Only the current registrant can generate or reveal it, and the gaining registrar cannot start a transfer without it. You will see the same thing called an EPP code, an authorization code, a transfer key, or a TAC depending on which registrar's help page you are reading. They are the same object.

How do I get an EPP code for my domain?

Log in to the registrar where the domain currently lives, open the domain's settings, turn off the registrar lock, and request the authorization code. Most registrars either display it on screen or email it to the registrant address on file within minutes. If the option is greyed out, the domain is locked, the WHOIS contact email is unverified, or the name is inside a policy hold period.

1. Log in to the losing registrar (the one that has the domain now).
2. Unlock the domain. Look for "registrar lock", "transfer lock", or "domain lock" and switch it off.
3. Check the registrant email. The code is often sent there, so it must be an address you can actually open.
4. Request the auth code and copy it exactly, including any symbols.
5. Start the transfer at the gaining registrar and paste the code when asked.
6. Approve the confirmation email so the transfer does not sit waiting for five days.

Why can't I transfer my domain?

The usual cause is a lock. Registrars apply a policy hold for a set period after a domain is newly registered or transferred in, and during that window no auth code will help. Historically that hold was 60 days. ICANN has approved replacing it with a 720-hour (30-day) lock, and registrars are phasing the change in through 2026, so what applies to your name depends on where it is registered and when it was last moved. The other common blockers are simpler: the registrar lock is still on, the registrant contact email was never verified, the domain is expired or in redemption, or there is an unpaid balance.

How long is an auth code valid?

Under the current standard, the code is generated on request and has a limited lifetime, commonly around 14 days, after which you request a fresh one. Registrars are also expected to store it securely rather than keep a permanent copy on your dashboard. Practically, that means you should get the code when you are ready to transfer, not weeks in advance, and if a code is rejected as invalid, the first thing to try is generating a new one.

How long does a domain transfer take with an auth code?

Five to seven days is normal, and it is mostly waiting rather than work. Once the gaining registrar submits the request with a valid code, the losing registrar has up to five days to release the name, though you can usually shorten this by approving the transfer manually in your account instead of letting the clock run out. The domain keeps resolving the whole time; a transfer moves the registration, not the DNS. Our guide to how long it takes to buy and transfer a domain breaks down each stage.

Do I need an auth code when I buy a domain from a marketplace?

Usually not. When you buy through a marketplace, the platform handles the handover, either by pushing the domain into your account at the same registrar (an internal push, which needs no code and completes in minutes) or by managing the registrar transfer for you. You supply an account at the receiving registrar and the seller supplies the name. This is one of the underrated advantages of buying a listed name: you never touch the code, and the money stays in escrow until the domain is confirmed in your account. If you are buying privately from an owner instead, the auth code is the moment the deal actually happens, so it must be tied to the escrow release.

Is it safe to share your domain auth code?

Treat it like a password, because that is what it is. Share it only with the registrar you are transferring to, or with an escrow agent as part of a transaction, and never post it in a public thread or send it to a buyer who has not yet funded escrow. Anyone with the code and an unlocked domain can pull the name into their own account. If you suspect a code has leaked, re-lock the domain and generate a new code, which invalidates the old one. Domain theft almost always traces back to a leaked code or a compromised registrar login, so turn on two-factor authentication while you are in there.

What happens after the transfer completes?

Check three things immediately. First, the domain shows in your account at the new registrar with the correct registrant details. Second, the DNS records are intact, since some registrars replace nameservers on transfer and quietly break your site or email. Third, auto-renew is on. A transfer normally adds a year to the registration, so note the new expiry date. It is worth putting a simple uptime check on the site for the week after a move, because the most common post-transfer failure is a DNS record that never came across and nobody noticed until customers called.

The bottom line on domain auth codes

The auth code is not complicated, it is just gated: unlock the domain, verify the contact email, request the code, and use it before it expires. If a transfer is blocked, look for a lock or a policy hold rather than a problem with the code itself. And if you are buying a name rather than moving one you already own, buy it somewhere the transfer is part of the service. Our premium domains are escrow-backed and transferred into your account as part of the purchase, and if you are buying privately, read how to transfer a domain name to a new owner first.