Overview
An EPP code (also called an auth code or authorization code) is a unique password-like string that proves you own a domain before transferring it to a new registrar. You get it from your current registrar's domain settings. It is required for every inter-registrar domain transfer and is typically valid for 7–30 days.
What Is an EPP Code?
An EPP code (also called an authorization code, auth code, or transfer key) is a unique password-like string of characters associated with your domain name. It serves as a security mechanism that proves you are the legitimate owner of a domain before a transfer to a new registrar is approved.
The name "EPP" comes from the Extensible Provisioning Protocol, the technical standard that governs how domain registrars communicate with domain registries. The EPP code is formally defined in this protocol as a required verification step for domain transfers.
What Does an EPP Code Look Like?
An EPP code is typically an alphanumeric string of 8–16 characters, often case-sensitive and sometimes including special characters. For example:
It's not a password you create yourself — it's generated by your current registrar and tied specifically to your domain.
Why Does the EPP Code for Domain Transfer Exist?
Before EPP codes were standardized, domain hijacking was much easier. A malicious actor could submit a transfer request on your behalf without your knowledge, and registrars had limited ways to verify legitimacy.
The EPP auth code requirement was introduced to ensure:
1. Only the verified domain owner can authorize a transfer
2. The transfer can't be initiated without access to the account or email address associated with the domain
3. Registrars have a standardized method for verifying transfer legitimacy across the global domain ecosystem
Think of it like the PIN on a bank card. You can have the card (the domain), but without the PIN (the EPP code), you can't perform the transfer.
When Do You Need an EPP Code?
You need an EPP code specifically when you are transferring a domain between registrars — moving it from your current registrar (where you bought it) to a new registrar.
Common Scenarios
Switching to a cheaper registrar: Domain prices vary. Moving from GoDaddy to Namecheap or Porkbun can save money annually.
Consolidating domains under one registrar: If you have domains scattered across multiple registrars, you may want them all in one place.
Switching to a registrar with better features: WHOIS privacy, DNS management tools, or security features may be better elsewhere.
Moving away from a registrar being shut down: If a registrar is going out of business, you'll need to transfer all domains — and you'll need EPP codes for each.
When You Don't Need an EPP Code
Renewing your domain at your current registrar
Updating DNS records
Changing WHOIS contact information
Enabling/disabling domain privacy
Transferring domain ownership within the same registrar (a registrar-internal ownership change)
How to Get Your EPP Code from Common Registrars
How to Get Your EPP Code from Namecheap
1. Log into your Namecheap account
2. Go to Domain List in the left sidebar
3. Click Manage next to the domain you want to transfer
4. Scroll down to the Transfer Out section
5. Click Auth Code to reveal your EPP code, or choose to have it emailed to your account's email address
6. Copy the code and keep it secure
Note: The domain must not be locked (Registrar Lock must be off) before you can use the auth code. Namecheap also requires the domain to be unlocked before sending the code.
How to Get Your EPP Code from GoDaddy
1. Log into your GoDaddy account
2. Go to My Products → Domains
3. Click the domain you want to transfer
4. Select Domain Settings
5. Scroll to Transfer domain away from GoDaddy
6. Click Get authorization code
7. GoDaddy will email the EPP code to your verified email address
How to Get Your EPP Code from Google Domains (Now Squarespace Domains)
1. Log into your account
2. Select the domain
3. Go to Transfer out or Settings
4. Unlock the domain first (disable transfer lock)
5. Click Get authorization code — it will be sent to your email
How to Get Your EPP Code from Other Registrars
1. Most registrars follow a similar process:
2. Log in to your account
3. Go to domain management settings
4. Disable the registrar/transfer lock
5. Request or reveal the auth code (via dashboard or email)
If you can't find the option, contact your registrar's support team and ask specifically for the "EPP transfer authorization code" for your domain.
Step-by-Step: How to Use an EPP Code for a Domain Transfer
Once you have your EPP code, here's how to complete the transfer:
Step 1: Prepare your current registrar
Disable the registrar lock (transfer lock)
Ensure your WHOIS email is current and accessible (you'll receive confirmation emails there)
Obtain the EPP code
Step 2: Initiate the transfer at the new registrar
Go to the new registrar's website
Find the "Transfer Domain" option
Enter your domain name and click to start the transfer
Step 3: Enter the EPP code
When prompted, paste the EPP code exactly as provided (it's case-sensitive)
Complete any checkout process (some registrars charge a transfer fee that includes a 1-year renewal)
Step 4: Approve the transfer via email
Check the email address associated with your domain's WHOIS record
You'll receive a confirmation email from either your old or new registrar (sometimes both)
Click the approval link in the email to confirm you authorize the transfer
Step 5: Wait for the transfer to complete
Domain transfers typically take 5–7 days
ICANN allows up to 7 days for the process to complete
Some registrars complete it faster if both sides process quickly
Common EPP Code Problems and Solutions
"Invalid auth code" Error
Double-check for extra spaces when copying the code
Ensure the code hasn't expired (most EPP codes are valid for 7–30 days)
Request a new code if it has expired
Confirm the domain lock is disabled
Not Receiving the Auth Code by Email
Check your spam/junk folder
Verify that your WHOIS email address is correct and accessible
If you have WHOIS privacy enabled, some registrars send the code to a masked address — check your privacy protection settings
Contact your registrar's support if the email doesn't arrive within 30 minutes
Transfer Is Rejected
Transfers can be rejected for several reasons:
The domain was registered or previously transferred within the last 60 days (ICANN restriction)
The domain has an active dispute or legal hold
The registrar lock was not properly disabled
The WHOIS contact information is incomplete or inaccurate
EPP Code Security Tips
Never share your EPP code in public forums or via unencrypted email
Request a new code immediately after a failed or cancelled transfer attempt
Keep your registrar account's email secure — whoever has access to your email can request an auth code
Enable two-factor authentication (2FA) on your registrar account to prevent unauthorized code requests
Expert Verdict
The EPP authorization code system is one of the most effective security mechanisms in the domain industry precisely because of its simplicity: a one-time, registrar-generated code that proves account-level ownership before any transfer is processed. For domain owners, the practical takeaway is that your registrar account email address is the most critical element of the entire security chain — anyone who controls that email address can request an EPP code and authorize a transfer.
This makes securing your registrar account email with two-factor authentication just as important as protecting the EPP code itself. The EPP code is only as secure as the email address it's sent to. Well-managed domain portfolios use a dedicated, monitored email address for registrar communications — one that is not shared across services and is protected with hardware-key 2FA.
For businesses transferring domains between registrars, the process is reliable but requires careful sequencing: unlock the domain, request the code, initiate the transfer, monitor your email, and approve the confirmation request promptly. Missing the email approval step is the second most common cause of failed or delayed transfers after the domain lock issue.
Frequently Asked Questions
What is an EPP code for a domain?
An EPP code is a unique alphanumeric authorization code tied to a specific domain name. It is generated by your current registrar and serves as proof of domain ownership when initiating a transfer to a new registrar. Without it, domain transfers between registrars cannot be completed.
How long is an EPP code valid?
Most EPP codes expire within 7–30 days of generation, depending on the registrar. If your transfer stalls and the code expires before it's used, you'll need to request a new code from your current registrar.
Can I use the same EPP code to transfer a domain multiple times?
No. EPP codes are single-use tokens. Once a transfer is successfully initiated with a code, the code is consumed. If you cancel a transfer or it fails, you must request a new code for the next attempt.
Why does my registrar email the EPP code instead of showing it on screen?
Emailing the code to the verified WHOIS contact adds a second verification layer — proving that the person requesting the transfer has access to the email address on the domain's WHOIS record, not just the registrar account login.
Is there an EPP code for country-code domains (.co.uk, .de, etc.)?
Country-code TLDs (ccTLDs) vary. Some use EPP codes similar to gTLDs; others have different transfer authorization mechanisms specific to their registry. Check with your current registrar for the specific process for each ccTLD you're transferring.
What is the ICANN 60-day transfer lock?
ICANN policy prohibits transferring a domain that was registered or transferred in the last 60 days. This prevents rapid successive transfers that could be used in domain theft. You must wait out the 60-day period before initiating a new transfer.
What happens if I provide the wrong EPP code?
The receiving registrar returns an error and the transfer is rejected. You can request the correct code from your current registrar and retry. Most registrars allow multiple attempts without penalty, but check whether repeated failed attempts trigger a security hold on the domain. ---
Conclusion
The EPP code for domain transfer is a simple but vital security tool that protects domain owners from unauthorized transfers. It's essentially a one-time password that proves ownership before your domain moves to a new registrar. Getting your auth code is straightforward — log into your registrar, find the transfer settings, disable the transfer lock, and request or copy the code.
If you're planning a domain transfer, the process becomes much smoother when you understand every step. And if you're looking for a registrar worth moving to, start with a search for the best available domains.
Use DomainsDiscovery.com to check domain availability and compare prices across registrars instantly.