When you go to transfer a domain from one registrar to another, you will be asked for an EPP code — also called an auth code, authorization code, or transfer key. It is a short string of characters that acts as the password for your domain’s transfer, proving to the new registrar that you genuinely control the name and authorising the move. Understanding what it is, where to find it, and how to handle it safely is essential to transferring a domain smoothly and securely.

This guide explains what an EPP or auth code is: its purpose as a transfer key, why the domain system requires it, where to find it in your account, how to use it in a transfer, keeping it secure, and troubleshooting when it does not work. By the end, this small but important piece of the transfer process will make complete sense.

What an EPP / auth code is

An EPP code — also known as an authorization code, auth code, auth-info code, or transfer key — is a unique string of characters assigned to your domain that authorises its transfer from one registrar to another. Think of it as a password specific to the act of transferring the domain: the new registrar requires it to confirm that the transfer is genuinely authorised by the domain’s rightful controller.

The name ‘EPP’ comes from the Extensible Provisioning Protocol, the technical system registrars use to communicate about domains, but you do not need to know the protocol — what matters is that the EPP code is the secret key that unlocks a transfer. Each domain has its own unique code, and it is required for most domain transfers between registrars.

So an EPP or auth code is simply the transfer password for your domain. When you want to move a domain to a new registrar, you provide this code to prove you have the authority to do so. It is a small string of characters with a specific, important job: authorising — and by its secrecy, protecting — the transfer of your domain.

Why the system requires it

The EPP code exists for security — to prevent unauthorized transfers of your domain. Because a domain is a valuable asset, and transferring it to another registrar is exactly the action a thief would take to steal it, the system requires proof that a transfer is genuinely authorised. The auth code is that proof: only someone with access to it can initiate a transfer.

This makes the code a key defence against domain hijacking. Combined with the registrar lock (which blocks transfers until you unlock the domain), the requirement for a unique auth code means an attacker cannot simply move your domain away — they would need both to unlock it and to obtain its secret transfer key, which is why keeping the code private matters so much.

So the auth code is not bureaucratic friction but a deliberate safeguard. By requiring a unique secret code to authorise any transfer, the domain system ensures that only the rightful controller of a domain can move it, protecting your name from being transferred without your knowledge. Understanding this explains why the code is required, why it is secret, and why you should guard it carefully.

Where to find your EPP code

You obtain your domain’s EPP code from your current registrar — the one you are transferring away from — and it is usually available in your domain management settings. The typical steps are consistent across registrars:

• Log in to your current registrar account, where the domain is presently registered.
• Open the domain’s settings or management page for the specific domain you want to transfer.
• Find the transfer or auth-code option — sometimes labelled EPP code, authorization code, or transfer key.
• Request or reveal the code: some registrars display it directly, others email it to your registered address for security.
• Unlock the domain if it is locked, since the registrar lock must be off to transfer.

So the code lives with your current registrar, in your domain’s settings, and you retrieve it there when you are ready to transfer. Some registrars show it on screen, others send it to your contact email as an extra security step. Either way, obtaining it is straightforward — and if you cannot find it, your current registrar’s support can provide it, since they are required to give you your auth code on request.

How to use it in a transfer

The EPP code is used at the new registrar — the one you are transferring your domain to. After you obtain the code from your current registrar and ensure the domain is unlocked, you begin the transfer at the new registrar and provide the auth code when prompted. The new registrar uses it to verify the transfer is authorised and to initiate the move.

From there, the transfer follows the standard process: the code authorises the request, both registrars coordinate the move, and you typically confirm the transfer via an email, after which the domain moves to the new registrar over a short period. The auth code’s job is specifically that initial authorisation — proving the transfer is legitimate — after which the rest of the process proceeds.

So in the flow of a transfer, the auth code is the key you hand to the new registrar to unlock the move. Get the code from the old registrar, unlock the domain, start the transfer at the new registrar, enter the code, and confirm — that sequence, with the auth code at its heart, is how a domain moves between registrars. The code is small, but it is the linchpin that makes the transfer possible.

Keeping your auth code secure

Because the EPP code is essentially the password to transfer your domain, keeping it secure is important. Do not share it with anyone you do not intend to transfer the domain to, and treat it with the same care as any sensitive credential — anyone who obtains it, combined with an unlocked domain, could initiate a transfer of your name.

Only retrieve and use the code when you are genuinely ready to transfer, and once a transfer is complete, the code’s job is done. It is good practice to have your domain locked (registrar lock on) at all times except during a deliberate transfer, so that even if a code were exposed, the lock provides an additional barrier against an unauthorized move.

So handle the auth code as the sensitive key it is: reveal it only when transferring, share it only with the intended new registrar, and keep your domain locked and your registrar account protected with a strong password and two-factor authentication the rest of the time. These practices ensure the code does its protective job — authorising your legitimate transfers while preventing anyone else from moving your domain.

Troubleshooting the code

If your EPP code does not work during a transfer, a few common issues are usually to blame. The most frequent is that the domain is still locked — the registrar lock must be turned off before a transfer can proceed, so an unlocked domain is a prerequisite even with the correct code. Check that you have disabled the lock at your current registrar.

Other issues include entering the code incorrectly (the codes can be long and contain special characters, so copy and paste rather than retype to avoid errors), an expired or regenerated code (some codes are time-limited or change, so request a fresh one if in doubt), and the domain being within a period where transfers are not allowed — such as too soon after registration or a previous transfer, which the rules restrict.

So if a transfer stalls on the auth code, check: is the domain unlocked, was the code entered exactly (ideally pasted), is the code current, and is the domain eligible to transfer right now? Addressing these resolves most auth-code problems. If it still fails, your current registrar’s support can confirm the correct code and check for any hold on the domain — the code itself is simple, so a failure almost always traces to one of these surrounding conditions.

A small key with a big job

The EPP or auth code is a small piece of the domain world with an outsized importance: it is the secret key that authorises transferring your domain between registrars, proving you control the name and protecting it from being moved without your permission. Understanding it removes the mystery from what can otherwise be a confusing step in a domain transfer.

Its role is twofold — enabling your legitimate transfers and, by its secrecy, preventing illegitimate ones. You obtain it from your current registrar, provide it to the new one to authorise the move, and guard it as the sensitive credential it is, keeping your domain locked and your account secure the rest of the time. When a transfer stalls, the auth code and its surrounding conditions (the lock, the code’s accuracy, transfer eligibility) are the first things to check.

So next time you transfer a domain and are asked for an EPP code, you will know exactly what it is, where to get it, how to use it, and how to keep it safe. It is a short string of characters, but it is the linchpin of a secure transfer — a small key doing the big job of moving your domain safely and only when you intend it to.

FAQs

What is an EPP or auth code?

An EPP code — also called an authorization code, auth code, or transfer key — is a unique string assigned to your domain that authorises transferring it from one registrar to another. It acts as the password for the transfer: the new registrar requires it to confirm the move is genuinely authorised by the domain’s rightful controller.

Why is an auth code needed to transfer a domain?

For security — to prevent unauthorized transfers. Because moving a domain to another registrar is exactly what a thief would do to steal it, the system requires a unique secret code as proof the transfer is authorised. Combined with the registrar lock, it means an attacker can’t simply move your domain away, guarding against hijacking.

Where do I find my domain’s EPP code?

From your current registrar (the one you’re transferring away from), usually in the domain’s management settings under a transfer or auth-code option. Some registrars display it on screen; others email it to your registered address for security. If you can’t find it, your registrar’s support must provide it on request.

How do I use an EPP code to transfer a domain?

Obtain the code from your current registrar and unlock the domain, then start the transfer at the new registrar and enter the code when prompted. The new registrar uses it to verify and initiate the move; you typically confirm via email, and the domain transfers over a short period. The code provides the initial authorisation.

How do I keep my auth code secure?

Treat it like a password: only retrieve and use it when you’re genuinely ready to transfer, share it only with the intended new registrar, and never expose it otherwise. Keep your domain locked (registrar lock on) except during a deliberate transfer, and protect your registrar account with a strong password and two-factor authentication.

Why isn’t my EPP code working?

Common causes: the domain is still locked (unlock it first — a prerequisite), the code was entered incorrectly (copy and paste rather than retype), the code is expired or was regenerated (request a fresh one), or the domain is in a period where transfers aren’t allowed (too soon after registration or a prior transfer). Check these; if it still fails, contact your current registrar’s support.

The bottom line

An EPP code — also called an auth code, authorization code, or transfer key — is the secret password for transferring your domain between registrars. It is a unique string assigned to your domain that proves you control the name and authorises the move, and the domain system requires it for security: because transferring a domain is exactly how a thief would steal it, demanding a unique secret code (alongside the registrar lock) ensures only the rightful controller can move a name, guarding against hijacking. So the code both enables your legitimate transfers and, by its secrecy, prevents illegitimate ones.

In practice, you obtain the code from your current registrar in your domain’s settings (some display it, some email it), unlock the domain, then provide the code to the new registrar to authorise and initiate the transfer, confirming via email. Guard it like any sensitive credential — reveal it only when transferring, share it only with the intended new registrar, and keep your domain locked and your account protected with a strong password and 2FA the rest of the time. If a transfer stalls, check the surrounding conditions: is the domain unlocked, was the code entered exactly, is it current, and is the domain eligible to transfer? The auth code is a small string of characters, but it is the linchpin of a secure transfer — now a step you can navigate with complete confidence.

When you are ready, you can start with Hostinger and use code PROTIPS for the reader discount. An EPP / auth code is the unique ‘password’ that authorises transferring your domain to a new registrar, proving you control the name and guarding against unauthorized transfers. Get it from your current registrar, unlock the domain, and enter it at the new registrar to start the move. Keep it secret, and if it fails, check the lock, the code’s accuracy, and transfer eligibility.