What Is an EPP Code and How do You Get It

You might own a domain, but if you don’t have your EPP code, you don’t fully own it. 

Yup, you read that right!

That little string of letters and numbers is the difference between you controlling your domain, or someone else hijacking it. 

Knowing how the EPP code works, how to find it, and how to protect it is one of the smartest moves you can make as a domain owner.

Now, allow me to take you through the whole thing.

What Exactly Is an EPP Code?

In the simplest terms, an EPP code stands for Extensible Provisioning Protocol code.

It is actually like a master passkey for your domain. 

It is a unique alphanumeric string, usually between 6 and 16 characters, that your registrar gives you. 

According to NiRA, the Nigeria Internet Registration Association, this code is mandatory whenever you want to transfer your domain to a different registrar.

So, if your domain were a house, the EPP code would be the secret key that proves you are the rightful owner, and only you can use it to give away control.

The EPP code protects your domain from being stolen or moved without your permission.

Why the EPP Code Is So Important

You see, this string of characters is far more important than you might think:

1) Security Barrier

The EPP code acts as a second line of defense for your domain. 

Even if someone gains access to your registrar account through phishing, password leaks, or other hacks, they cannot transfer your domain without this code. 

Many registrars actually emphasize that this key is what prevents unauthorized domain transfers, keeping your digital property safe.

2) Ownership Confirmation

Whenever you decide to move your domain to a new registrar, the EPP code is the official proof that you are the rightful owner. 

Without it, the new registrar cannot process the transfer. 

The EPP code is what confirms that the transfer request is legitimate. 

3) Anti-Hijacking Measure

Domain hijacking is a real threat. 

To NiRA, the EPP code is a primary safeguard against illegal domain transfer. 

If any malicious person tries to move your domain without your consent, the absence of the correct EPP code blocks the transfer immediately. 

4) Status Awareness

EPP codes also tie into domain status indicators, like clientTransferProhibited. 

These codes show whether your domain is locked, unlocked, or ready for transfer. 

In Nigeria, these statuses are standardized through the Extensible Provisioning Protocol, which means registrars and registries follow consistent rules for protecting domains. 

How EPP Actually Works

Let us take a quick stroll behind the curtain for those who enjoy knowing what happens under the hood.

EPP is simply a protocol that helps registrars and domain registries communicate in a clean, predictable way.

And get this, it runs on XML, that old-school markup language.

But don’t let that scare you. The goal of EPP is structure, not complexity.

Now, this is what actually happens:

When you decide to transfer a .com.ng domain, your new registrar sends a message to the registry using EPP. 

Inside that message is your EPP code, the little key you retrieved from your current registrar. 

The registry then checks the code. 

If the code matches the one on file, the transfer proceeds. If it doesn’t, everything stops right there.

That is the entire backbone of the process:

Your new registrar passes the code → the registry verifies it → the domain moves.

Simple but secure.

Now, here is where things get a bit more interesting.

EPP also comes with status codes, and these codes tell you what your domain is allowed or not allowed to do at any given moment. 

NiRA uses these for .ng domains to keep everything organized and safe.

You will see codes such as:

• clientTransferProhibited: your registrar has locked your domain
• serverHold: the registry has paused the domain
• pendingTransfer: the transfer request is currently in motion

These codes help maintain order and prevent shady activity. If a domain is locked, it won’t budge, even if someone has the EPP code. 

If it is pending transfer, other actions are temporarily frozen. 

One thing many people don’t know?

Registrars are required to give you the EPP code when you ask for it, as long as you are the verified owner. 

This isn’t optional. 

ICANN’s rules make it clear, registrars cannot hold your domain hostage or refuse access to your transfer key.

So even though EPP sounds like something reserved for engineers, it is actually pretty straightforward on your end.

How to Get Your EPP Code

This is how you actually obtain that code from your registrar.

Step1: Log in to Your Registrar Dashboard

Head into your domain dashboard and open the section where your domain names are listed. 

Everything starts here because the EPP code always lives inside your domain management panel.

Step 2: Unlock Your Domain

Most registrars keep domains locked by default to prevent unauthorized transfers, so you need to switch off the Registrar Lock or Transfer Lock.

Also double-check that domain privacy or protection features are disabled, because some registrars hide the EPP code until privacy layers are turned off.

Step 3: Request the EPP Code

Look for buttons like Get EPP Code, Auth Code, or Transfer Code inside your domain settings. 

For example, on Truehost, you simply open your Client Area → Domains → Manage Domain. 

And you will see the option to request or view your EPP code depending on your domain’s settings.

Step 4: Save the Code Securely

Once you receive the code, store it somewhere safe, like a password manager or a protected notes app. 

Treat it with the same care you would give to a banking password. If someone gets it, they could move your domain without your permission.

What to Do with the EPP Code

Once you have the EPP code in hand, it is time to use it correctly. This part matters more than people realize.

1) Use it to start a domain transfer

When you move your domain to a new registrar, this code is required during the transfer request. 

The new registrar will ask for it early in the process, and without the correct code, the transfer will stop right there.

2) Share it only where it is absolutely required

The only places this code should ever go are your new registrar’s transfer form or a trusted technical person helping you with the move. 

Avoid sending it on WhatsApp, posting it in tickets unnecessarily, or storing it in plain text emails. 

3) Avoid reusing or leaving it exposed

Some registrars automatically regenerate a fresh EPP code after a transfer, while others allow you to reset it manually. 

If yours gives that option, generate a new code once the transfer is complete. That closes the door on anyone who might still have the old one.

4) Re-enable your domain lock immediately

Domains are usually unlocked only to allow transfers. 

Once the process starts, or immediately after it finishes, turn the registrar lock back on. 

This small step prevents unauthorized transfer attempts and keeps your domain secured moving forward.

Final Thoughts

Now that you have read this far, you are no longer in the dark about EPP codes. 

You know what they are, why they exist, how they work, and how real domain transfers actually happen behind the scenes. 

That alone puts you ahead of a lot of domain owners.

So the practical next move? Log in to your registrar. Locate your EPP code. Store it somewhere secure.

And when the time comes to transfer your domain, whether it is for better support, better pricing, or better performance, be sure to trust us at Truehost to handle your domain for you.