100% Australian owned and operated
The short answer
Your .com.au domain password (auth code) comes from the company managing the name, your registrar or reseller: reveal it in their dashboard, ask in writing, or use auDA’s (.au Domain Administration’s) recovery tool, pw.auda.org.au, which emails only the registrant contact address on record. If that inbox is dead, auDA’s rules say the registrar must verify you’re the registrant (the licence holder) and release the code within two calendar days.
- auDA’s recovery email goes to the registrant contact address on record, and nowhere else.
- If that address is dead, the code alone isn’t enough: a .au transfer can’t go through while the contact details are wrong, so ask for them to be updated in the same letter.
- If someone else holds the licence, it isn’t a password problem. It’s a change of registrant.
- Treat the code like a password. Anyone with it, and an unlocked domain, can start moving the name.
Which route fits your situation?
It depends on two things: who can read the registrant contact inbox, and who holds the licence. Two terms first. The registrant is the business or person that holds the licence. The registrant contact is the person, and email address, the registrant nominates to deal with the domain. The code goes to the contact.
Find your situation in the first column. Every row except the last is about .au names. The times are what the rules allow: auDA’s for .au and, for .com and similar endings, those of ICANN (the Internet Corporation for Assigned Names and Numbers). They aren’t a promise of how fast any one provider moves.
| Your situation | Route | Who acts | Typical time (what the rules allow) |
|---|---|---|---|
| You can read the registrant contact inbox | Reveal the code in your provider’s dashboard, ask them for it in writing, or use pw.auda.org.au | You (or your provider, if you ask in writing) | auDA’s tool: as soon as its email arrives. A written request: within two calendar days (Registrar Rules 2.10.8) |
| auDA’s email never arrives, or its link has already been used | Check which address is on the record, then ask again with link scanning relaxed, or ask your provider | You, then your provider | As above |
| The inbox is dead, but your business is still the registrant | Ask the registrar or reseller, in writing, to verify you, release the code and update the registrant contact email | The registrar, with proof from you | Code: within two calendar days (Registrar Rules 2.10.12). Updates to details other than who the registrant is: two calendar days after a written request (Licensing Rules 2.18.6). The identity check itself varies by provider. |
| A former web designer, IT (information technology) provider or staff member is the contact, and your business is the registrant | Ask them to forward the code. If they can’t or won’t, use the dead-inbox route above | Them, or the registrar | As above |
| The agent who arranged it, such as a web designer, registered it in their own name in the last 14 days | Ask them, as the registrant on record, to request a correction from the registrar. Only the registrant can ask, and only for a genuine error. If they won’t, see the next row | The agent, then the registrar | Within 14 calendar days of the licence being recorded (Licensing Rules 2.18.2–2.18.4) |
| Someone else holds the licence, such as a designer’s business or a former partner | Ask them to agree to a change of registrant. If they won’t: a complaint to the registrar, then an auDA review; the auDRP (.au Dispute Resolution Policy) for competing legal rights; or legal advice | The holder, then the registrar, auDA or a dispute provider | Registrar: 30 calendar days for a complaint, unless it sets a new timeframe. auDA review: ask within 28 calendar days for most decisions; auDA then has 28 days, unless it sets a new timeframe. No fixed total. While a complaint is open, the licence can’t move to another registrar (Licensing Rules 2.13.8). |
| The business was sold or restructured | A change of registrant, not just the code | Both parties, then the registrar | Ask within 28 calendar days of the agreement to transfer the licence, unless it says otherwise (Licensing Rules 2.13.4). The registrar checks eligibility and has two calendar days from the request (2.13.3) |
| It’s a .com, .net or .org | Your registrar’s auth code screen, or a request to them | The registrar | If the registrar doesn’t let you get the code yourself, within five calendar days of your request (ICANN Transfer Policy) |
Worth doing today, even if you’re not moving. Ask your provider which address is the registrant contact, and change it if nobody reads it any more. It’s where codes and transfer confirmations go. auDA’s rules expect a registrant to keep its details accurate and to tell the registrar about changes within 14 calendar days (Licensing Rules 2.11.8–2.11.9).
What is a .com.au domain password?
It’s the code you give a new provider to prove you’re entitled to move the name. auDA describes it as “needed to authorise important actions such as transferring a .au domain name”.
It goes by several names: domain password, auth code, authInfo and EPP code (after EPP, the Extensible Provisioning Protocol that registrars use to talk to the registry). They all mean the same thing.
auDA’s Licensing Rules set the format: 13 to 32 characters, with at least one letter and one number, and no dictionary words. The registrant can have it changed at any time, has to keep it secure, and has to report it if it’s lost or stolen.
Registrant or registrant contact: whose inbox is it?
The code goes to the registrant contact, who isn’t always the registrant. Plenty of “who’s got our domain?” problems turn out to be “whose email is the contact?”
| Registrant | Registrant contact | |
|---|---|---|
| Who it is | The business or person that holds the licence | A person the registrant nominates. For a company, auDA’s rules say it must be “a principal, employee or member of the Registrant”. For an individual, it’s the registrant or their authorised agent. Never the registrar. |
| Role in getting the code | Entitled to it. The registrar’s identity check confirms this when the contact is dead. | Receives it, from auDA’s tool and from your provider, unless the registrant authorises someone else in writing |
| On the public record | Yes, name and email | auDA’s web lookup shows the contact’s name and email address, so check it there first. |
| How it changes | A change of registrant, or a correction the registrant requests for a genuine error within 14 days | The registrant asks the registrar in writing |
Where do I get my .com.au domain password?
From the registrar or reseller that manages the name, or from auDA’s recovery tool. A registrar is a company accredited to make changes in the .au registry; a reseller sells and supports names through one.
- Your provider. Many let you reveal the code in their dashboard. Or ask in writing: auDA’s Registrar Rules give the registrar two calendar days to provide it to the registrant or the registrant contact (2.10.8), and the Licensing Rules say it goes only to the registrant contact unless the registrant authorises someone else in writing (2.12.10).
- Don’t know who your provider is? Look the name up at auDA’s WHOIS (the public lookup of who holds a domain) at whois.auda.org.au, or start from the WHOIS tab of our toolbox, which links to the official record. auDA’s rules list the registrar, and any reseller, among the details on the public record, but the reseller field is often blank, so the registrar shown may be a wholesale company you’ve never dealt with.
auDA’s recovery tool is the other route. The registry, the central database of .au names, is operated by Identity Digital, and the tool works like this:
Enter the name
At pw.auda.org.au, the form asks for just two things: the domain name and your name.
Check the registrant contact inbox
The registry emails a single-use link to the registrant contact address on record. auDA says it “cannot be redirected to another email address”.
Open the link once
It shows the domain password, along with the creation date, the licence expiry date and the registrar. Neither the tool nor auDA’s help page says how long the link stays valid, so use it soon.
Keep it safe
Paste it into the new provider’s transfer form. Don’t email it around.
Why didn’t the recovery email arrive?
Usually because it went to an address you don’t check, or because security software used the link before you did.
- It went to the registrant contact. That might be a former staff member, a web designer, or a mailbox at an internet provider you left years ago.
- A scanner clicked first. Some email security tools open links to test them. Identity Digital, the registry operator, warns that this can “use up the one-time click functionality”, and suggests changing those settings or contacting your registrar.
To find out which address is on file, ask your provider or check their dashboard. If it’s one nobody can read, carry on to the next section.
What if the registrant email is dead?
If your business is still the registrant, the registrar has to sort it out. auDA’s Registrar Rules say that where the contact details are out of date, the registrar must “validate the identity of the Registrant” and provide the code within two calendar days, to the registrant or to a representative the registrant has nominated in writing (2.10.12).
Ask for the contact email to be updated in the same letter. The registrar isn’t allowed to transfer a licence while the contact details in the registry are incorrect or incomplete (2.10.13), and the new provider’s confirmation request can go to the registrant contact too (2.11.7). A code with a dead inbox behind it only gets you halfway.
One clause can look like a dead end. The ordinary two-day duty doesn’t apply if the registrant hasn’t kept its contact details accurate (2.10.9). The identity check in 2.10.12 is the way through, so if a provider points to the first clause, point back to the second.
Check who the registrant is
Look the name up at whois.auda.org.au. If the registrant is your business, carry on. If it’s someone else, skip to the next section.
Find who manages it
auDA’s rules list the registrar, and any reseller, among the details on the public record, but the reseller field is often blank, so the registrar shown may be a wholesale company you’ve never dealt with. If you pay a reseller, start with them; they place requests with the registrar.
Put it in writing
Email them asking for three things: verify that you act for the registrant, release the code to you (or to someone you nominate in writing), and update the registrant contact to an address you can read. Name the field you want changed (the registrant contact email) and give the new address.
Prove who you are
Each provider runs its own identity check and decides what proof it needs, so ask. Expect to show that the business is the registrant and that you’re entitled to act for it.
Then move it, if you still want to
Once you have the code and the new contact address works, start the transfer. See what happens next.
auDA’s Licensing Rules let the registrant ask, in writing and at any time, for details other than who the registrant is to be updated, as long as the request names the field to change, and give the registrar two calendar days to update the registry (2.18.5–2.18.6). When you choose the new address, pick one that doesn’t depend on one person: a shared address such as domains@ works well, as long as somebody reads it, ideally one that isn’t at the same domain as the one you might lose.
What if a web designer, IT provider or former employee is in the way?
If your business is the registrant, you don’t need their permission: ask your registrar to verify you and update the registrant contact. If they or their business are the registrant, the licence is theirs on paper, and the code won’t change that.
If your business is the registrant, ask them to forward the code if they’re willing; if not, use the dead-inbox route. For a company, auDA’s rules expect the contact to be a principal, employee or member of the registrant. A former employee or an outside designer doesn’t fit that description, which is one more reason to update it.
If someone else is the registrant, such as a designer’s business or a former partner:
- Within 14 days of registration. auDA’s correction process covers a licence registered “in the name of the reseller or other agent” who arranged it. Only the registrant on record can ask for it, so the agent has to make the request, within 14 calendar days of the licence being recorded and only for a genuine error (Licensing Rules 2.18.2–2.18.4). An agent registering for someone else has to make sure that person is recorded as the registrant in the first place (2.2.6).
- After that. The holder has to agree to a change of registrant. Our guide to changing the registrant on a .com.au covers how.
- If they won’t agree. Complain to the registrar of record first, then ask auDA to review its decision (timeframes below). Where two parties have competing legal rights to a name, auDA points to the auDRP. Or get legal advice. Each is a formal process with its own criteria, not a shortcut.
A note on words: auDA’s “correction” is only for genuine errors in who the registrant is. Fixing a dead contact email isn’t a correction; it’s an update to the registrant contact.
Not legal advice. This is general information about auDA’s rules, not legal advice. If who holds the licence is disputed, get advice.
What if the business was sold or restructured?
After a sale or restructure, the password isn’t enough. The code moves a name between providers; it doesn’t change who holds the licence.
Putting the licence in the new holder’s name is a change of registrant. It’s requested in writing, the registrar checks eligibility on both sides, and auDA’s rules give it two calendar days from the request (Licensing Rules 2.13.1, 2.13.3). There’s also a deadline: the registrant has to ask within 28 calendar days of the parties entering the contract or agreement to transfer the licence, such as a business sale, unless that agreement says otherwise (2.13.4). Our change of registrant guide walks through it. This is general information, not legal advice.
If the old company has been deregistered, act quickly. auDA treats its licence as cancelled 30 calendar days later, unless there are documents showing the company agreed to transfer it before it ceased, and a cancelled licence can’t be transferred (Licensing Rules 2.11.2–2.11.3). The change of registrant guide covers what to do once a company has been deregistered.
Eligibility matters for a move between providers too: the registrant has to be eligible when the transfer happens (Licensing Rules 2.13.8). If the old ABN (Australian Business Number) has been cancelled, read how the ABN check works on a .com.au first.
Can my provider refuse, delay or charge me for the code?
Your provider can’t sit on it: auDA’s rules give the registrar two calendar days, and ban fees for the transfer itself. The two days apply whether you ask in the ordinary way (Registrar Rules 2.10.8) or the registrar first has to check your identity because the contact details are out of date (2.10.12). And a registrant is “not required to pay a fee for the transfer” between registrars (Licensing Rules 2.13.9).
- Charges. We found nothing in the rules about a charge for releasing the code after an identity check, so if that matters to you, ask up front.
- If the code doesn’t arrive. Make a complaint to the registrar of record, in the form it asks for (Licensing Rules 3.4.1). It has 30 calendar days to resolve it unless it sets a new timeframe, and must give written reasons and explain your right to a review. If you’re unhappy with the outcome, or it doesn’t decide, you can ask auDA for a review, within 28 calendar days for most matters. auDA then has 28 days, unless it sets a new timeframe (Licensing Rules 3.4–3.5; auDA’s complaints process).
- An open complaint blocks a move. While a complaint about the licence is open, it can’t be moved to another registrar (Licensing Rules 2.13.8).
I’ve got the code. What happens next?
Give it to the new provider, then keep an eye on the registrant contact inbox.
- A written yes. The new registrar sends a confirmation to whoever asked for the transfer or, if that’s someone else, to the registrant contact, and needs a written yes back (Registrar Rules 2.11.7).
- A check from the old registrar. It may send one email to the registrant contact within two days, to make sure the move is authorised (2.11.9–2.11.10).
- The wait. Once the transfer is approved, auDA says “it can take up to three days for the transfer to take effect”.
- Afterwards. Change the code within two calendar days, or the new registrar may reset it (Licensing Rules 2.12.7–2.12.8).
auDA’s transfer conditions don’t include a waiting period after registration (Licensing Rules 2.13.8). The 60-day rules you may have read about are ICANN’s, for .com and similar endings. The transfers lesson has the full process, including how to move without your website or email dropping out.
What about .com, .net and .org names?
Those generic top-level domains (gTLDs) follow ICANN’s Transfer Policy, not auDA’s rules, and its 60-day rules still apply. If your registrar doesn’t let you get the code yourself in its dashboard, it must provide it within five calendar days of your request.
| Rule | In force on 6 October 2026 | Once ICANN’s approved changes take effect |
|---|---|---|
| After a new registration | The registrar may deny a transfer for 60 days | 30 days (720 hours), applied by every registrar |
| After a transfer between registrars | The registrar may deny another for 60 days | 30 days (720 hours), applied by every registrar |
| After a change of registrant | A 60-day transfer lock, which some registrars let you opt out of | The lock is removed |
| Start date | Current policy, updated 21 February 2024 | None set. ICANN lists the work under “Implementation Projects In Queue”. |
Has the 30-day change happened yet? No. ICANN’s Board adopted the recommendations of its Transfer Policy Review (a review of ICANN’s transfer rules) on 7 June 2026, in resolution 2026.06.07.04, and directed implementation “subject to prioritization”. The policy text still has to be drafted, and ICANN hasn’t set an effective date. As at 6 October 2026 the 60-day rules apply, so any start date you see quoted for the change didn’t come from ICANN.
The locks section of the transfers lesson explains how the rules work in practice. Weighing up which ending to use in the first place? See .com.au vs .au vs .com.
I got a password recovery email I didn’t ask for. Should I worry?
Usually not. Anyone can ask auDA’s tool for a domain’s password, but the registry operator says “the password will only be sent to the authorised email address”. If it landed with you, the system did its job.
Don’t share the code or forward the email. If you’re not sure an email is genuine, don’t click its link; ask your provider instead. If you’re uneasy, check the domain is locked against transfer and ask your provider to change the code; the registrant can have it changed at any time (Licensing Rules 2.12.3). Letters and emails offering to “transfer” or “renew” your domain are a different matter: see domain renewal scams in Australia.
Why not let it expire and register it again?
Because someone else can get there first. Under auDA’s rules the registrant can renew an expired licence within 30 calendar days; after that, the name becomes “available to the public on a First Come, First Served basis” (Licensing Rules 2.14.4–2.14.5).
Your website and email also stop when the domain expires, so the gamble costs you either way. What happens when a .au expires has the timeline.
At Chill Domains. If your domain is with us, sign in, open the domain’s transfer-out page and type the domain name to confirm: the code shows for 60 seconds. You can rotate it to a new code, which stops the old one working, and we email the registrant every time the code is revealed or rotated. There’s no transfer-out fee and no retention call. If the domain is locked, the page tells you to unlock it first.
If the registrant inbox on a .au is dead, the dashboard can’t fix it: the .au registrant details are read-only there, and the self-serve contact fix sends its link to that same inbox. Email us at info@digitalgreenhouse.com.au instead, and a person will reply within one business day.
Moving a name to us? A transfer code is needed for every ending, .au included, and we check it with the registry before you pay.
Questions people ask
How long does a registrar have to provide a .au auth code?
Is an EPP code the same as a .com.au domain password?
Does the pw.auda.org.au link expire?
Can the code be sent to a different email address?
How do I find out who my registrar is?
Do a .com.au and the matching .au share one password?
Can I change my .com.au domain password?
Is there a waiting period before a new .com.au can be transferred?
Terms in this guide
- Auth code
- The password that proves you’re allowed to move a domain to a different registrar. For .au names it’s usually called the domain password.
- Registrant
- The person or organisation a domain is registered to. For a .au, the holder of the licence.
- Registrar
- A company accredited to add and change names in a registry.
- Reseller
- A business that sells and supports domains through an accredited registrar, without being a registrar itself.
- auDA
- .au Domain Administration, the not-for-profit organisation that administers .au and sets its rules.
- EPP
- Extensible Provisioning Protocol, the language registrars use to talk to registries. “EPP code” is another word for the auth code.
- WHOIS
- The public lookup that shows whether a domain is registered and through which registrar.
- Licence
- What you hold when you register a .au domain: the right to use the name for a set period.
- Change of registrant
- Putting a domain into a different person’s or business’s name. A separate process from moving between registrars.
- Registrar lock
- A setting that blocks a domain from being transferred to another registrar until you switch it off.
- ICANN
- Internet Corporation for Assigned Names and Numbers, which coordinates domain names worldwide and sets the transfer rules for .com and similar endings.
- gTLD
- Generic top-level domain: an ending that isn’t tied to a country, such as .com, .net or .org.
Every term, in full, is in the glossary.
Sources
All read on 6 October 2026.
- .au Domain Administration Rules: Registrar (auDA, June 2026 version): who can be the registrant contact (2.9.2); the two-day deadline for the code (2.10.8); the dead-contact route (2.10.9, 2.10.12); no transfer while contact details are wrong (2.10.13); the transfer confirmation and the losing registrar’s check (2.11.7, 2.11.9–2.11.10).
- .au Domain Administration Rules: Licensing (auDA, June 2026 version): agents (2.2.6); a deregistered registrant’s licence and the 30-day cancellation (2.11.2–2.11.3); keeping details accurate and reporting changes within 14 days (2.11.8–2.11.9); the code’s format, changes and who receives it (2.12.3–2.12.11); change of registrant, its 28-day deadline and transfer conditions (2.13.1, 2.13.3–2.13.4, 2.13.8–2.13.9); expiry (2.14.4–2.14.5); corrections and updates (2.18.2–2.18.6); the public record (2.18.13, Schedule D); complaints and reviews (3.4–3.5).
- Password recovery (auDA): the email goes only to the registrant contact and can’t be redirected; the single-use link and what it shows.
- Domain passwords (aka authorisation codes) (auDA): what the password is for.
- .au domain password recovery tool (auDA; operated by Identity Digital Australia): the form asks for the domain name and the requestor’s name, and states no link-validity period.
- Transfer your .au domain name between registrars (auDA): up to three days once a transfer is approved.
- How auDA’s complaints process works (auDA): complaint and review timeframes.
- Disputes over domain names (auDA): what the auDRP is for.
- Frequently asked questions (Identity Digital Australia, the .au registry operator): anyone can request a password but only the authorised address receives it; security scanners and the single-use link.
- Transfer Policy (ICANN, updated 21 February 2024): the five-day deadline for the code where the registrar has no self-serve option, and the 60-day rules in force.
- Approved Resolutions, Regular Meeting of the ICANN Board, 7 June 2026 (ICANN): adoption of the Transfer Policy Review recommendations, resolution 2026.06.07.04.
- Implement Policy (ICANN): the Transfer Policy Review listed under “Implementation Projects In Queue”, with no effective date.
- GNSO Council Recommendations Report to the ICANN Board: Transfer Policy Review (ICANN’s Generic Names Supporting Organization, 31 March 2025): the 30-day (720-hour) restrictions, which every registrar must apply, and the removal of the change-of-registrant lock.
Keep reading
- Changing the registrant on a .com.au: for a sale, a restructure or a name in the wrong hands.
- Transfers, locks and status codes: the whole move, step by step.
- What the public record shows for a .au, and why it should be right.
- Registry, registrar and reseller: who does what.
- The ABN check on a .com.au renewal.
- Domain renewal scams in Australia, including fake transfer letters.
- Keeping your domain safe: a ten-minute check-up.