What is a domain auth code (EPP code)?

What the code actually is

Think of the auth code as a key to one domain. It is a string of letters, numbers and symbols made by your current registrar for that domain. You may also see it called an EPP code, authorisation code, AuthInfo code or transfer key. They all mean the same thing.

ICANN, the body that sets the rules for generic extensions, describes it as a security measure against fraudulent or unauthorised transfers. ICANN does not issue the code itself. Your registrar does.

If you own a .com, .net or .org, this is the code you will need the day you decide to move to a new company.

Why gTLD transfers need it

Generic extensions such as .com can be moved between registrars. The new registrar needs proof that the request is genuine, or anybody could try to pull your name away. The auth code is part of that proof.

The process normally runs like this:

• Ask your current registrar to unlock the domain.
• Get the auth code from them.
• Give the code to the new registrar and start the transfer.
• Approve the confirmation message if one is sent.

How to get your auth code

Many registrars let you generate the code yourself from the control panel, usually near the domain lock setting. Others make you send a request. Under ICANN's transfer policy, a registrar that does not offer self-service must supply the code within five calendar days of your request.

Only the registered owner, or someone authorised by them, should ask for it. Make sure the email address on the domain is one you can still open. If you bought the name through a freelancer or an agency, ask whose name sits on the record. See /guides/ for more on checking ownership, and /com-domain/ if your name ends in .com.

Keep the code secret

Anyone holding the code could try to move your domain, so treat it like a bank PIN.

Good habits for small-business owners and freelancers:

• Do not post it in a public WhatsApp group or a shared document.
• Send it only to the registrar or buyer you are actually dealing with.
• Generate it only when you are ready to transfer.
• Ask for a new one if it was ever sent to the wrong person.
• Re-lock the domain if you change your mind.

Why .pk and .com.pk work differently

Pakistan's own extensions follow PKNIC's rules, not the usual gTLD routine. On its change-registrar page, PKNIC says a .pk name can be moved only while it has not expired. It asks for original signed documents: an affidavit (individuals) or an authority letter (companies), plus a clear CNIC copy. The affidavit goes on Rs 100 stamp paper attested by an oath commissioner. The originals are posted to PKNIC's Lahore office, and scans are not accepted.

PKNIC then verifies the documents by phone, and the move takes roughly three to four business days after verification. It says registrars outside Pakistan may be able to use a transfer code, at PKNIC's discretion. Read /pk-domain-transfer/ before you start. Also remember PKNIC fixes the registrant name at registration, so choose it carefully through /register-pk-domain/.

Where SastiDomains fits

We are a small Pakistani company, not a registrar. Our marketplace lets owners sell existing domains, with the buyer's payment held in escrow. Browse it at /#browse or list a name at /#sell.

When a gTLD changes hands, the seller usually provides the auth code once payment is secured in escrow. Our registration service checks availability live at /domains/ and registers new names in your own name through PKNIC or a registrar. If you are weighing a sale, /sell-domain/ explains the steps, and /buy-domain/ covers the buyer side.

Common questions