Quick answer
What is an auth code (EPP code)?
An auth code (EPP code, AuthInfo or transfer key) is the password a registrar issues to prove you may move a domain. Under ICANN rules, as of October 2026, your registrar must make it available within 5 calendar days of your request. At TransferOffshore you paste it next to the domain in the transfer form, never in an email.
Auth code: key facts
| What it is | A per-domain password stored at the registry and checked when a transfer is requested |
|---|---|
| Who gives it | Your current registrar, from its dashboard or by email to the registrant |
| ICANN deadline | 5 calendar days from your request, when the registrar has no self-service tool |
| Payment disputes | A registrar may not hold the code back because you owe it money |
| Lifetime today | No fixed lifetime for gTLDs; ccTLDs vary, from 7 days (.be) to 40 days (.eu) |
| .uk | No code: the current registrar changes the IPS tag |
| Coming change | A one-time Transfer Authorization Code (TAC), valid 14 days, once the new ICANN policy takes effect |
| In our form | One code per row, hidden while you type; up to 20 rows per request |
What is an auth code called at different registries?
It has many names, but it is always the same thing: a secret that proves the transfer request comes from the holder. EPP, the protocol registrars use to talk to registries, calls the field AuthInfo. Registrars and registries then give it their own labels.
- AuthInfo
The EPP field name, used by DENIC for .de and in most registry documents.
- EPP code / auth code
The usual name in registrar dashboards for .com, .net, .org and most gTLDs.
- Transfer key
The name used for .fi by Traficom; the registrar must give it within 5 working days.
- Transfer authorisation code
The EURid name for the .eu code, valid 40 days or until used.
- Authorisation code (formerly UDAI)
The .nz name, valid 30 days and issued for a single transfer.
- Token
The SIDN name for .nl; the registrar must supply it within 5 days.
- Transfer Authorization Code (TAC)
The new ICANN name in the policy adopted on 7 June 2026, not yet in force.
- IPS tag
Not a code: the .uk label of a registrar at Nominet, changed to move a domain.
Where do registrars put the auth code?
Either in the domain's settings in the dashboard, or in an email sent to the registrant contact. You usually have to turn off the transfer lock first. Some examples, per each registrar's help pages as of October 2026:
- Cloudflare: Manage Domains › Manage › Configuration › Unlock, then copy the code; “Regenerate” issues a new one.
- Gandi: the domain's “Transfer out” tab, with a button to generate a new key. Only the owner or admin contact sees it.
- Porkbun: the Details menu › Get Authorization Code.
- Namecheap: sent by email to the registrant.
- Squarespace: emailed to the registrant within 24 hours; each new request creates a new code, and only the latest one works.
If the code shows “unavailable”, the domain is usually inside its 60-day period after registration or transfer. Every registrar we cover is in the transfer from… guides.
How long is an auth code valid?
For gTLDs, the current ICANN policy sets no fixed lifetime, so it depends on the registrar. Country registries often set one. Get the code when you are ready to submit it, not days ahead.
| Extension | Validity | Notes | Source |
|---|---|---|---|
| .com, .net, .org and other gTLDs | No fixed lifetime today | Some registrars replace the code on each request; only the newest works | ICANN Transfer Policy |
| .de | 30 days, one transfer only | DENIC can send an AuthInfo by registered mail if the provider is inactive (paid) | DENIC (primary) |
| .eu | 40 days, or until used | Also available from EURid's My .eu or as an emergency code | EURid (primary) |
| .be | 7 days | Requested through the registrar, emailed by DNS Belgium to the holder | DNS Belgium (primary) |
| .es | 10 days, or until used | Sent to the administrative contact, who must accept by email within 10 days | Red.es (primary) |
| .nz | 30 days, single use | No charge may be made for changing registrar | InternetNZ (primary and secondary) |
| .fi | 30 days | Traficom can provide it if the registrar does not within 5 working days | Traficom (primary) |
| .uk | No code | IPS tag change; code-based transfers from 9 February 2027, according to Realtime Register | Nominet and Realtime Register |
| gTLDs under the new policy | 14 days (336 hours), single use | Adopted 7 June 2026; no effective date as of 19 October 2026 | GNSO Final Report |
Some of these extensions (.eu, .be, .es) are not sold here; they are listed because the rules differ so much. The full per-extension table is transfer rules by extension.
Can a registrar refuse to give you the auth code?
No, not for long, and never as leverage. The ICANN Transfer Policy requires a registrar without self-service to give the code within 5 calendar days of the holder's first request. It may not withhold it over a payment dispute.
A registrar may still deny the transfer itself for a reason the policy allows, such as the 60-day period after registration. And it must deny during a UDRP case or under a court order. Those are limits on the transfer, not on the code. The common blocks are in why a domain cannot be transferred.
How do you keep an auth code safe?
Treat it like a password: anyone who holds it while the domain is unlocked can start a transfer. A few rules keep it under your control.
- Never send it by email or chat. We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat.
- Never put it in a URL. Our pre-filled link carries only the name, such as
/app/domains/transfer?name=example.com, never the code. - Ask for it late. Request the code just before you submit it, and generate a new one if it has leaked.
- Relock after a failure. If you cancel a transfer, turn the transfer lock back on at the old registrar.
- Watch the registrant inbox. The losing registrar's emails about the transfer go there, and you can reject an unwanted request.
Once the domain has arrived, request a fresh code from the new registrar if you ever need one; do not reuse the old one.
How do you enter auth codes in the TransferOffshore form?
One code per domain, typed on the same row as the name. The transfer form shows a Domain field and a Transfer code field on each row. The code field is hidden as you type, with a Show button.
- Add another domain adds a row, up to 20 per request.
- Paste a list takes one
domain codepair per line, for a whole batch at once. - Spaces before and after the code are removed. A code must be 1 to 128 printable characters; otherwise the form asks you to enter it exactly as your registrar gave it.
- The code is kept only for your browser session, not saved in the cart.
- A .uk transfer needs no code: support handles the IPS tag change with you.
If the old registrar rejects a code, the domain shows Failed in My domains with the reason, and a field to send a corrected code.
What changes when the auth code becomes a TAC?
The code gets a fixed lifetime and a single use. The Transfer Policy Review, adopted by the ICANN Board on 7 June 2026, renames AuthInfo as the Transfer Authorization Code (TAC):
- the registrar must set and issue it within 120 hours (5 days);
- it is valid for 336 hours (14 days), a limit the registry enforces;
- it is one-time use: the registry resets it once a valid TAC is accepted;
- you get a notice no later than 10 minutes after it is issued.
As of 19 October 2026, no effective date has been published, and today's rules still apply. Follow it on ICANN transfer policy changes.
Auth code questions
Is the auth code the same as the EPP code?
Yes. Auth code, EPP code, AuthInfo and transfer key all name the same per-domain secret. EPP is the protocol registrars use with registries, and AuthInfo is its field name. The new ICANN policy will call it the Transfer Authorization Code (TAC) once it takes effect; no date is published as of October 2026.
My auth code is rejected. What should I do?
Request a new code at the old registrar and copy it without extra spaces. A code fails when it was mistyped, replaced by a newer one, expired under a ccTLD rule, or out of sync with the registry. In TransferOffshore, open the failed domain in My domains and send the corrected code from there.
How long does my registrar have to give me the code?
Five calendar days for gTLDs, when the registrar has no self-service tool. Many show the code at once in the dashboard. Country registries set their own deadlines: SIDN gives .nl registrars 5 days, and Traficom gives .fi registrars 5 working days.
Can someone steal my domain with the auth code?
Only if the domain is also unlocked, and you would usually see emails about it. Keep the transfer lock on until you are ready, request the code just before you use it, and never send it by email. If you receive a transfer notice you did not expect, reject it at your registrar at once.
Do I need an auth code for a .uk domain?
No. A .uk domain moves when the current registrar changes its IPS tag to the gaining registrar's tag, and the expiry date stays the same. Nominet plans to move to code-based transfers on 9 February 2027, according to Realtime Register.
Does TransferOffshore charge for the auth code when I leave?
No. The auth code is free, from your account, at any time, and there is no exit fee. The usual ICANN timing still applies: many registrars refuse a new transfer within 60 days of the last one. The steps, from unlocking to the new registrar, are on transfer out.
Sources (16)
- Transfer Policy (updated 21 February 2024) — ICANN (checked 2026-10-19)
- Transfer Policy (2016 text) — ICANN (checked 2026-10-19)
- Transfer Policy Review PDP Final Report — ICANN GNSO (checked 2026-10-19)
- Provider transfer of .de domains — DENIC (checked 2026-10-19)
- How can I obtain a transfer authorisation code — EURid (checked 2026-10-19)
- Transfer code — DNS Belgium (checked 2026-10-19)
- Domain name transfers procedure (October 2024) — Red.es (checked 2026-10-19)
- .nz Rules, version 3.2 (17 March 2026) — InternetNZ (checked 2026-10-19)
- How can I change registrar — Traficom (checked 2026-10-19)
- Transferring your domain name — SIDN (checked 2026-10-19)
- Nominet standardises .uk domains from February 2027 — Realtime Register (checked 2026-10-19)
- Transfer out from Cloudflare — Cloudflare (checked 2026-10-19)
- Transferring a domain out docs.gandi.net/en/domain_names/transfer_out/index.html — Gandi (checked 2026-10-19)
- How to transfer a domain from Porkbun to another registrar kb.porkbun.com/article/27-how-to-transfer-domain-from-porkbun-to-another-registrar — Porkbun (checked 2026-10-19)
- How do I transfer a domain from Namecheap to another registrar namecheap.com/support/knowledgebase/article.aspx/258/84/how-do-i-transfer-a-domain-from-namecheap-to-another-registrar — Namecheap (checked 2026-10-19)
- Transferring a domain away from Squarespace — Squarespace (checked 2026-10-19)
Have your code? Start the transfer
Paste the domain and its auth code; up to 20 per request. .com $12.49 with a year added, no ID, paid in crypto.