An auth code, also known as an authorization code, EPP code, transfer code, or domain auth info, is a unique security value used to approve a domain transfer from one registrar to another. If you plan to move a domain to a new hosting or domain provider, this code is usually required to prove that you are the current domain holder or that you are allowed to manage the transfer.
For website owners, this is one of the most important parts of a safe domain move. Without the correct auth code, a transfer will usually fail. With the wrong timing or missing checks, you can also interrupt DNS services, website access, or email delivery. In a managed hosting environment, this matters even more because domain changes often affect nameservers, zone records, and mail routing.
What an auth code is used for
An auth code helps prevent unauthorized domain transfers. It works like a one-time secret that confirms the transfer request. In most cases, the gaining registrar or hosting platform asks for this code before it starts the transfer process.
Typical uses include:
- Moving a domain name to a different registrar
- Transferring a domain into a hosting platform that includes domain management
- Changing registrar while keeping website and email services under control
- Authorizing ownership-related changes for certain domain operations
In a control panel such as Plesk, the auth code is not usually used for website configuration itself. Instead, it is part of the registrar-side process. However, the transfer often has side effects on DNS, so it is common to review A, AAAA, MX, and TXT records before and after the move.
When do you need an auth code?
You normally need an auth code when transferring a domain from one registrar to another. This is the most common scenario for domain ownership changes. The code is usually required for most generic top-level domains and many country-code domains, although the exact rules depend on the registry.
Common situations where you need one
- You are moving your domain to a new registrar
- You are consolidating domains under one provider
- You are switching to a hosting company that manages both hosting and domain services
- You are changing providers after a contract renewal or service review
- You want to move a domain while keeping website and email records unchanged
Situations where you may not need one
- Changing only the nameservers, without transferring the domain
- Editing DNS records in the current DNS zone
- Updating website files, databases, or mailboxes in your hosting account
- Moving a site between servers while keeping the same registrar
It is important to distinguish between a domain transfer and a DNS change. Many users think that changing nameservers is the same as transferring a domain, but it is not. A nameserver change only affects where DNS is hosted. An auth code is generally needed for registrar transfer, not for routine DNS updates.
How an auth code works in a domain transfer
The transfer process usually follows a standard sequence:
- You unlock the domain at the current registrar if required.
- You request the auth code from the current provider.
- You submit the code to the new registrar or hosting platform.
- The transfer is approved by the registry and/or confirmed by email.
- The domain moves to the new provider after the transfer completes.
Some registrars make this process faster and simpler, while others add extra verification steps. In Europe, it is common to see strong confirmation flows for account security and ownership protection.
The auth code itself is typically valid for a limited time or until it is regenerated. If a transfer is delayed too long, you may need to request a fresh code.
Before you request the auth code
Before starting a transfer, it is wise to check a few technical and account-related points. This helps avoid downtime and failed transfers.
- Check domain status: Make sure the domain is not within a transfer lock period.
- Confirm contact email access: Transfer confirmation messages may go to the registrant email address.
- Review DNS records: Save current zone records if your DNS will change during the move.
- Check website dependencies: Note whether the site uses external services, such as mail filters, CDNs, or API endpoints.
- Plan email continuity: Mailboxes and MX records should be preserved or recreated at the new provider.
If your domain is used for business email, a transfer without preparation can interrupt inbound mail. This is especially relevant when DNS is managed separately from the website platform. In Plesk or similar environments, you can export or document DNS settings before making registrar changes.
How to get an auth code
The exact steps depend on your registrar, but the general process is similar across most hosting and domain platforms.
Typical steps
- Sign in to your current registrar account.
- Open the domain management area.
- Select the domain you want to transfer.
- Disable domain lock if required.
- Request the auth code or transfer code.
- Check the account email or control panel message center for the code.
Some providers display the code immediately in the account dashboard. Others send it by email, or require a support request. If you use managed hosting, the hosting team may be able to guide you through the process, but the code is still usually issued by the current registrar, not by the hosting platform itself.
If you do not see the code
- Check whether the domain is locked
- Review account permissions if there are multiple users
- Look in the registrant contact email inbox and spam folder
- Confirm that the domain is not under an administrative hold
- Contact support if the registrar requires manual release
Auth code, domain lock, and transfer protection
Most domains also have a transfer lock or registrar lock. This is separate from the auth code. The lock prevents unauthorized transfers until it is removed. In many systems, both are needed:
- Domain lock: Must often be turned off before a transfer can begin
- Auth code: Must be provided to authorize the transfer
These protections are there to reduce fraud and accidental loss of control. They are especially important for domains linked to customer portals, shop systems, and company email.
In some cases, domains may have registry-level restrictions. For example, recently registered domains or recently updated registrant data may not be transferable for a short period. Always verify the rules for the specific TLD before planning a move.
What can happen if the auth code is wrong or expired
If you enter an incorrect code, the transfer will be rejected. If the code has expired or been regenerated, the transfer request may also fail. This usually does not affect the website itself immediately, but it can delay the registrar move and create confusion if the transfer window is time-sensitive.
Common issues include:
- Transfer stuck in pending status
- Failure to validate the domain authorization
- Repeated approval requests
- Delays in moving DNS management to the new provider
If a transfer fails, request a new auth code and confirm that the domain is still unlocked. Also make sure the admin contact email is active and able to receive transfer notices.
How to keep website and email safe during a transfer
A domain transfer should not automatically break your website or email, but only if DNS and hosting are handled correctly. The safest approach is to prepare in advance.
Recommended checklist
- Back up website files and databases
- Export DNS records or document them carefully
- Confirm where DNS is hosted before the transfer
- Keep the old DNS active until the new setup is verified
- Make sure MX, SPF, DKIM, and DMARC records are ready
- Test mail delivery after the transfer
- Check that the website resolves correctly from multiple locations
If you use a control panel such as Plesk, it is helpful to compare the DNS zone before and after the transfer. This is particularly useful when a hosting platform also manages mail services. A small missing TXT record can affect email authentication, and a missing MX record can stop incoming messages.
Practical example
Suppose you transfer example.eu from one registrar to another. The domain itself moves successfully, but the old registrar had been hosting the DNS zone. If you do not recreate the records at the new provider, the website may stop resolving and email may bounce. The auth code only authorizes the registrar move; it does not preserve DNS automatically.
Auth codes and European domain transfers
For European customers, domain transfers often involve additional attention to registry rules, contact data accuracy, and GDPR-related account processes. The exact requirements vary by extension, but the same basic principle applies: the auth code proves that the transfer is authorized.
When working with EU domain names, it is a good idea to:
- Confirm the registrant details are up to date
- Keep a valid administrative email address on file
- Check whether the TLD has special transfer rules or waiting periods
- Plan DNS changes separately from the transfer itself
For business websites, the safest migration sequence is usually: prepare DNS, request the auth code, start the transfer, verify resolution, then confirm email flow.
Best practices for hosting and control panel users
If you manage your website in a hosting control panel, the transfer should be treated as part of a wider service change. The domain transfer, DNS settings, and mail configuration are connected even if they are managed in different places.
Useful operational tips
- Keep a written record of the current DNS zone
- Note any custom subdomains used by apps, staging, or portals
- Check whether the SSL certificate depends on domain validation records
- Verify cron jobs, webhooks, and external integrations after the move
- Update contacts if the domain administration changes hands
In Apache-based hosting environments, the web server configuration itself does not depend on the auth code. However, if the domain points to a new hosting account after transfer, you should confirm that virtual host configuration, redirects, and SSL settings are still correct.
Frequently asked questions
Is an auth code the same as a password?
Not exactly. It is a transfer authorization value, not a regular login password. It is used specifically to approve a domain move between registrars.
Do I need an auth code to change nameservers?
Usually no. Changing nameservers is a DNS action, not a registrar transfer. You may need to sign in to your registrar account, but not necessarily to use an auth code.
Can I transfer a domain without unlocking it?
Usually not. Most registrars require the domain to be unlocked before a transfer can start. The auth code alone is often not enough.
Will my website go offline during transfer?
It should not, if DNS is planned properly. The transfer itself does not normally break the website, but incorrect DNS changes or missing records can cause downtime.
Does the auth code move my email too?
No. The auth code only authorizes the domain transfer. Email service depends on DNS, mailbox setup, and the hosting provider that manages mail.
How long is the auth code valid?
This depends on the registrar. Some codes remain valid until changed, while others expire after a limited time. If in doubt, request a fresh code before submitting the transfer.
What should I do if the transfer fails?
Check whether the domain is unlocked, confirm the code is correct, make sure the contact email is accessible, and verify any registry restrictions for the TLD.
Summary
An auth code is a key security step in a domain transfer. You need it when moving a domain from one registrar to another, but not usually for simple DNS updates or website changes. For hosting customers, the most important part is to separate the transfer process from DNS and email continuity planning.
Before starting a registrar move, make sure the domain is unlocked, the contact email is accessible, and your DNS records are backed up. If you manage your site through a control panel such as Plesk, review the zone data and mail settings so the transition stays smooth. Used correctly, the auth code helps protect your domain while allowing a safe and controlled transfer to a new provider.