Domain Auth Code (EPP Code)
What a Domain Auth Code Does
A domain auth code is a secret password that a registrar creates so that a domain can be moved to another registrar. It is also called an EPP code or authorization code, after the Extensible Provisioning Protocol (EPP), the standard that registries and registrars use to manage domain records.
Most generic top-level domains, such as .com, .net and .org, require an auth code before a transfer can start. The receiving registrar cannot begin the move without it. In that sense the code shows that the request comes from someone who controls the domain's account, not just someone who knows the domain name.
How the Code Is Issued and Used
The current registrar, the company where the domain is held now, generates the code. Most registrars show it in the domain's management panel, and some send it by email when asked. The owner then gives the code to the new registrar, which uses it to request the domain transfer from the registry.
Codes are not permanent. Many registrars let a code expire after a set period, and requesting a new code usually replaces the old one. A copy saved months earlier may stop working, so the current code should always be requested fresh.
Why the Code Must Stay Private
Anyone who holds the auth code and can access a registrar account may try to move the domain. For that reason the code should be handled like a password. Sending it in plain email, pasting it into a shared document or giving it to someone who does not need it all increase the risk.
The most serious misuse is domain hijacking, where a thief moves a domain away from its owner. A registrar lock can block a transfer even when someone has the code.
Example: Moving a Domain to a New Provider
A small bakery registered its domain through a hosting company years ago and now wants to manage it with a different provider. The owner asks the current registrar for the auth code, which appears in the domain's settings. The new provider uses that code to start the transfer. The owner keeps the code private and watches the transfer notices sent to her contact email, so she can object if the request was not hers.
Frequently asked questions
Is a domain auth code the same as a password?
Not exactly, but it works in a similar way. A domain auth code is a separate code used only for transfers, not for logging in to an account. Anyone who holds it can start a transfer, so it deserves the same care as a password.
Can someone transfer my domain with only the auth code?
Usually not. A transfer also needs a registrar account that accepts the request, and the domain must not be locked. Registrar locks and the confirmation steps built into the transfer process can stop an unwanted move, which is why keeping both the code and the account secure matters.
How long does an auth code stay valid?
It depends on the registrar and the registry. Many codes expire after a set period, and requesting a new code usually replaces the old one. If a code has expired, ask the current registrar to generate a new one before starting the transfer.