Key takeaways
- An auth code (also called an EPP code, transfer code or, for .au names, the domain password) proves you’re allowed to move a domain to a new provider.
- It is not your account login, and each .au domain has its own unique code.
- For .au domains, you can get it from your provider or from auDA’s recovery tool at pw.auda.org.au. It’s emailed to the registrant contact.
- For .com and other global domains, ICANN requires your registrar to give you the code within five calendar days of asking.
A domain auth code is a private password attached to one domain name. The provider you’re moving to asks for it to prove the domain’s holder approves the transfer. You get it from your current provider, and for .au domains you can also request it from auDA directly.
What does an auth code actually do?
It stops someone moving your domain without your permission. ICANN describes it as “a code created by a registrar to help identify the domain name holder and prevent unauthorized transfers” (ICANN). Without it, the new provider can’t take the domain over.
auDA is clear that the code “is not your account login”, and that it “is unique for each .au domain name licence” (auDA, Transfer your .au domain name). Treat it like a house key. Don’t share it around.
How do you get the auth code for a .com.au?
- Check your registrant email. Look up your domain in the auDA WHOIS. The code is sent to the registrant contact email, so make sure it’s an address you can access.
- Ask your current provider, or use auDA’s tool. Log in and look for “EPP code”, “domain password” or “transfer code” in the domain settings. Or go to pw.auda.org.au and request it yourself.
- Give the code to your new provider. They’ll validate the details. auDA says the transfer can take up to three days to take effect once approved.
There’s no auDA fee to move a .au domain between registrars. You must still be eligible to hold the domain, and it can’t be under a complaint, dispute or court proceedings. For the full process, see our guide to transfer .com.au domain names without breaking your website or email.
How do you get it for a .com or other global domain?
Global domains like .com follow ICANN’s rules instead of auDA’s. Some registrars let you generate the code in your account. Others make you ask. Either way, “your registrar must provide you with the AuthInfo code within five (5) calendar days of your request” (ICANN).
Watch for transfer locks. A registrar may refuse a transfer within 60 days of a domain’s first registration or a previous transfer. ICANN also blocks transfers for 60 days after a change to the registrant’s name, unless you opted out where offered. Turn off any “registrar lock” in your account before you start.
ICANN’s Board adopted a revised Transfer Policy on 7 June 2026, with implementation still to be scheduled (ICANN Board resolution). Lock periods and code rules for global domains may change, so check your registrar’s current terms. Moving away from a big provider? Our neutral guide explains how to transfer domain from GoDaddy, Crazy Domains or VentraIP.
What if your old provider won’t give you the code?
For a .au domain, you don’t need their help. As long as you can open the registrant contact email, auDA’s recovery tool will send you the code. If that email is out of date, ask the provider to update it, then request the code.
If a provider refuses to cooperate, lodge a complaint with the registrar of record. If you’re still not satisfied, ask auDA to review it (auDA complaints process). For a .com, remind the registrar of ICANN’s five-day rule in writing.
In our experience, the most common blocker isn’t an unhelpful provider. It’s a registrant email that belonged to a former staff member or an old web designer. Fix that first and the rest is usually quick.
Before you start, run through our domain transfer checklist so your email and website keep working during the move.
When you’re ready, you can transfer your domain to WMS or register your domain with WMS. If your website is moving too, every hosting plan includes a free website migration.
Frequently asked questions
Is an EPP code the same as an auth code?
Yes. EPP code, auth code, authInfo code, transfer code and domain password all describe the same thing: a unique code that authorises moving one domain to a new registrar. Different providers use different labels, so search your account for any of them.
Where do I find my .com.au domain password?
Ask your current provider, or request it from auDA’s recovery tool at pw.auda.org.au. Either way, it’s sent to the registrant contact email recorded in the .au registry. If you can’t access that email, ask your provider to update the contact details first.
Does an auth code expire?
It can change, depending on the registrar, and the revised ICANN Transfer Policy may tighten the rules for global domains. If your new provider says the code is invalid, request a fresh one from your current registrar rather than retyping the old one.
Is it safe to give my auth code to a new provider?
Yes, if you’re transferring the domain to them. That’s what the code is for. Don’t share it with anyone else, and be wary of unexpected emails asking for it. A real transfer only starts when you choose to move the domain.
Sources
- Transfer your .au domain name, auDA, accessed 13 November 2026
- How auDA’s complaints process works, auDA, accessed 13 November 2026
- FAQs for Registrants: Transferring Your Domain Name, ICANN, accessed 13 November 2026
- Approved resolutions, regular meeting of the ICANN Board, ICANN, 7 June 2026