What Is an EPP Code and How to Get One

## What Is an EPP Code and How to Get One If you've ever tried to move a domain name from one registrar to another, you've encountered the EPP code — also called an authorization code, auth code, transfer key, or domain transfer code. It's a string of characters that proves you're authorized to transfer the domain. Without it, the receiving registrar will reject the transfer request. This guide explains what an EPP code is, why it exists, how to obtain one from any major registrar, and what to do if things go wrong during the transfer process. ## What Is an EPP Code? EPP stands for Extensible Provisioning Protocol — the technical standard that registrars use to communicate with domain registries (the organizations that manage TLDs like .com, .net, and .org). The EPP code (formally called the "authorization information" or "authInfo") is one of the protocol's security mechanisms. When you initiate a domain transfer, the receiving registrar submits a transfer request to the registry. The registry requires proof that the transfer is authorized by the current domain owner. The EPP code provides this proof — it's like a one-time password for the transfer operation. Think of it as a combination lock on a transfer: - The transfer lock prevents the transfer from initiating at all - The EPP code proves identity once the transfer lock is removed Both mechanisms must be addressed for a transfer to succeed: the transfer lock must be disabled, and the correct EPP code must be provided. ## Why the EPP Code System Exists Before EPP authorization codes, domain hijacking was easier. Unauthorized transfers required no special verification beyond convincing a registrar's customer support team to initiate one. The EPP authorization system was introduced as part of ICANN's Inter-Registrar Transfer Policy (IRTP) to add cryptographic verification to the transfer process. The combination of transfer lock + EPP code + registrant email confirmation creates a three-factor check: 1. Transfer lock must be explicitly disabled (requires account access) 2. EPP code must match the registry's stored value (requires knowledge only the current registrar has) 3. Transfer confirmation sent to registrant email must be approved (requires email account access) Compromising any one factor alone is insufficient to complete an unauthorized transfer. ## How EPP Codes Are Generated Your Domain Registrar generates the EPP code and stores it at the registry alongside your domain record. The code is typically a random alphanumeric string of 8-16 characters, sometimes longer. Examples: ``` K2mN9!xZ aBcD1234eFgH5678 8x2k$mNqR9vP ``` Some registrars let you view and reset the EPP code through your control panel. Others generate a new one each time you request it. The code may expire after a set period (typically 48-72 hours) — if you obtain a code and don't complete the transfer promptly, you may need to request a new one. ## How to Get Your EPP Code ### Generic Process 1. Log into your registrar account 2. Navigate to domain management for the domain you want to transfer 3. Disable the transfer lock (labeled "Transfer Lock," "Registrar Lock," or "Domain Lock") 4. Look for an option labeled "Get Auth Code," "Transfer Code," "EPP Code," or similar 5. The code will be displayed in the interface and/or emailed to the registrant email address 6. Copy the code exactly, including any special characters ### Registrar-Specific Instructions **Namecheap**: My Account → Domain List → Manage [domain] → Sharing & Transfer → Auth Code → Send by Email. The code is emailed to the registrant address. **GoDaddy**: My Products → Domains → [domain] → Domain Settings → Transfer Domain Away. GoDaddy emails the auth code to the registrant contact email. **Cloudflare**: Domain Registration → [domain] → Transfer Out → Unlock → Confirm. Cloudflare displays the code and emails it. **Google Domains / Squarespace Domains**: Domain → Settings → Transfer out → Unlock → Get Authorization Code. Emailed to account email. **Network Solutions**: My Account → Domain Names → [domain] → Change Domain Registrar → Get Authorization Code. **Name.com**: My Domains → [domain] → Transfer Out → Disable Lock → Request Auth Code. ### When the Code Doesn't Appear Sometimes the EPP code isn't immediately available through self-service. Reasons include: **Domain recently registered**: Most registrars and ICANN policy prohibit transfers within 60 days of the initial registration date. If your domain is less than 60 days old, you cannot transfer it — this is by design. **Domain recently transferred**: Similarly, domains cannot be transferred for 60 days after a prior transfer completed. This is called the transfer lock period and prevents rapid successive transfers that could be used to obscure ownership. **Domain under legal hold or dispute**: If your domain is involved in a dispute or legal proceeding, the registry may have placed a serverTransferProhibited status preventing any transfer. **Registrar policy**: Some registrars have additional waiting periods or require manual verification before issuing EPP codes. Contact customer support in these cases. ## The Full Transfer Process Understanding where the EPP code fits in the broader transfer workflow: **Step 1 — Preparation at current registrar**: - Verify the domain is eligible for transfer (60+ days since registration/last transfer) - Disable the transfer lock (clientTransferProhibited) - Update registrant email to an address you actively monitor - Obtain the EPP code **Step 2 — Initiate at receiving registrar**: - Begin the "Transfer In" or "Transfer Domain" process - Enter the domain name and the EPP code when prompted - Select registration period (most transfers include a 1-year extension) - Complete payment (many registrars charge a transfer fee or include the transfer in a 1-year renewal) **Step 3 — Confirmation process**: - The receiving registrar submits the transfer request to the registry - The current registrar receives notification and may email you asking for confirmation or objection - The registrant email receives a transfer approval request (approve to speed up; ignoring it results in automatic approval after ~5 days) **Step 4 — Transfer completion**: - Once approved (or after the automatic approval window), the registry processes the transfer - The domain moves to the new registrar, typically within 24-48 hours of approval - Configure DNS, enable transfer lock, and verify settings at the new registrar ## Common EPP Code Problems and Solutions **"Invalid auth code" error**: The most common issue. Causes: - Typo when entering the code — check for similar-looking characters (0 vs O, 1 vs l, etc.) - Code expired — request a new one; codes typically expire within 48-72 hours - Code was already used — each EPP code is typically single-use; request a new one - Wrong domain — verify you have the code for the correct domain name **"Domain not eligible for transfer"**: The domain is within the 60-day lock period after registration or a prior transfer. Check the original registration date and calculate eligibility. **"Domain has transfer prohibition"**: A serverTransferProhibited status is present. Contact your current registrar to understand why and resolve it before proceeding. **Code emailed to inaccessible address**: If the registrant email in WHOIS is outdated and you can't access it, contact registrar support. You'll need to prove domain ownership through alternative means — this process varies by registrar and may require documentation. **Current registrar delays**: Some registrars are slow to issue EPP codes or respond to transfer requests. ICANN's IRTP policy requires registrars to respond within 5 calendar days. If your registrar is unresponsive beyond this window, you can file a complaint with ICANN. ## After the Transfer: Immediate Actions Once the transfer completes: 1. **Enable transfer lock** at the new registrar immediately 2. **Verify DNS settings** — transfers sometimes reset nameservers to the new registrar's defaults 3. **Enable WHOIS privacy** if it was active at the previous registrar 4. **Confirm auto-renewal** settings at the new registrar 5. **Update your domain inventory** with the new registrar, transfer date, and new expiration date ## EPP Codes for Different TLDs EPP authorization codes are standard for most gTLDs, but ccTLD transfer processes can differ: **.uk domains**: The transfer process uses a different mechanism — instead of an EPP code, you change the "IPS Tag" (registrar tag) to your new registrar's tag. No authorization code is involved. The process is initiated differently and requires understanding Nominet's specific transfer rules. **.au domains**: Australia's .au domains follow a unique process with different authorization mechanisms and timelines managed by .au Domain Administration (auDA). **.de domains**: DENIC requires an authorization token for .de transfers, similar in concept to EPP codes but managed through DENIC's own systems and with specific process requirements. **.eu domains**: EURid (the .eu registry) has its own transfer authorization system with different expiration timelines for the authorization token. **New gTLDs**: Most new gTLDs (those from the 2012 expansion round) use standard EPP authorization codes. The process is identical to .com transfers. Before attempting to transfer a ccTLD, research the specific registry's transfer process — don't assume the EPP code model applies. ## Security Considerations for EPP Codes The EPP code is a single-factor authentication mechanism. Protect it accordingly: **Treat the code as a temporary secret**: Once you receive an EPP code, use it promptly. Don't store it in insecure locations (unencrypted email, plain text files). After the transfer completes, the code becomes invalid — no ongoing security risk remains. **Verify the transfer request before approving**: When you receive a transfer confirmation email asking you to approve or deny a transfer, verify that you actually initiated it. Fraudulent transfer requests rely on registrants approving emails they receive without verifying they initiated the transfer themselves. **Use a registrar with good transfer audit trails**: Quality registrars log all lock disable operations and EPP code requests with timestamps and IP addresses. These logs are valuable when investigating any suspected unauthorized activity. WHOIS Lookup Tool Understanding Domain Lock and Its Importance domain-transfer-complete-guide Domain Grace Periods Explained