AuthInfo / EPP code — what is it and when do you need it?
Author: Domeny.ForSale editorial team Published Updated
In brief: An AuthInfo code, also known as an EPP or transfer code, is used to authorise a domain transfer between registrars. It is usually not needed to change hosting, DNS servers or registrant details. Treat it like a confidential password and obtain it only when you are ready to start the transfer.
What is an AuthInfo or EPP code?
AuthInfo is a unique string of characters assigned to a domain that confirms that the person initiating the transfer is authorised to do so. The term “EPP code” comes from the protocol used to manage many global domains. In practice, “AuthInfo”, “AuthCode”, “EPP code” and “transfer code” often refer to the same type of security credential.
The code is issued by the current registrar, meaning the company that handles the domain’s registration. It is not your customer account password, registrant number or assignment code. How it is provided depends on the registrar and the domain extension: the code may be visible in your account dashboard, sent to a verified address or issued after you submit a request.
Not all extensions use the same procedure. Before transferring a domain, you therefore need to check the terms and conditions of both the current and the new registrar, as well as the rules of the relevant domain registry.
When you need the code
The code is used primarily when moving a domain to another registrar. A transfer does not mean selling the domain or moving the website. It changes the company responsible for maintaining and renewing the registration.
For example: a domain is registered with company A, but its registrant wants to pay for it and manage it through company B. They obtain AuthInfo from company A, initiate the transfer with company B and enter the code in the appropriate form. Depending on the extension, confirmation by email or through the account dashboard may also be required.
AuthInfo is usually not needed when:
- you change your website or email hosting, but the domain stays with the same registrar;
- you set different DNS servers or DNS records;
- you update the registrant’s contact details;
- you assign the rights to the domain to another person or company — this may require a separate assignment procedure;
- you renew the domain with your current registrar.
An assignment and a transfer can take place alongside each other, but they address different issues. An assignment changes the domain’s registrant, while a transfer changes its registrar.
How to transfer a domain securely
First, check that the contact details associated with the domain are up to date and that you have access to the mailbox used for confirmations. Also make sure that the domain does not have a transfer lock. The names used for such locks and how to disable them depend on the account dashboard and the type of domain.
Then follow these steps:
- Start preparing before the domain’s expiry date, rather than at the last minute.
- Obtain the code from your current registrar through its official channel.
- Enter it only in the new registrar’s dashboard or form.
- Approve any required confirmation messages and monitor the transfer status.
- Once the transfer is complete, check the domain’s expiry date, registrant details, DNS settings and renewal method.
A registrar transfer alone usually does not change the DNS configuration, so the website and email can continue working without interruption. However, do not assume this without checking: if the existing DNS servers or services were part of the old provider’s package, their availability after the transfer may depend on the terms of that service.
How to protect the code against domain hijacking
Share the transfer code only with someone who is knowingly carrying out the transfer. Do not send it through a public messaging channel, include it in a support ticket accessible to many employees or give it to a contractor solely to change DNS settings.
It is also worth securing your registrar account with a strong, unique password and multi-factor authentication, if available. A compromised email account may allow someone to approve operations involving the domain, so it also needs separate protection.
If you receive an unsolicited message about a transfer, do not click the links it contains. Log in directly to your registrar’s dashboard, check the domain’s status and contact its support team. If the code has been exposed, ask for it to be changed or invalidated, provided the applicable procedure allows this.
What to check for a specific extension
Processing times, fees, code validity periods, transfer locks and the effect of a transfer on the expiry date are not the same for .pl, .com, .eu and other extensions. They may also change as providers update their terms and conditions.
Before requesting a transfer, confirm these conditions in the current documentation of the registry and both registrars. A practical next step is to check the domain’s expiry date, transfer lock and AuthInfo issuance procedure in your dashboard — without obtaining or sharing the code until you have chosen a new provider.
See also: Fake Spotify email: how to spot it and what to do
Read also
