Unlock a Namecheap Domain and Get the Auth Code for Transfer

If your registrar lock is still active or your auth code has a typo, your domain transfer fails immediately. You don’t want to find that out after paying your new registrar and waiting three days for an update. You need to unlock the domain in Namecheap, avoid tripping the sneaky 60-day ICANN lockout, grab your EPP transfer code, and verify that the registry actually reflects the change from your terminal.

I ran into this headfirst while migrating twelve client domains off an old Namecheap reseller account. Half of them failed on the first handshake simply because someone had updated the registrant email thirty minutes prior. That change triggered an automatic 60-day ICANN transfer hold. Here’s how to check your status upfront so you don’t end up stuck in support ticket limbo.

The Pre-Transfer Checklist and the 60-Day Lock Rule

Every ICANN registrar enforces rules to stop domain hijacking. If your domain trips any of these flags, Namecheap won’t release it, or your destination registrar will reject the transfer immediately:

• The 60-day creation rule: The domain must be at least 60 days old. If you bought it three weeks ago, you’re stuck waiting.
• The 60-day transfer rule: If you moved the domain between registrars recently, you can’t move it again until 60 days have passed.
• Change of Registrant lock: Changing the registrant first name, last name, organization, or email address in Namecheap can trigger an opt-outable 60-day transfer hold under the ICANN Transfer Policy.
• Accessible admin email: Namecheap sends the transfer auth code to your account email address. Make sure you can actually log into that inbox.

Pay close attention to that registrant rule. If you edit your contact details in Namecheap right before a transfer, look for the checkbox asking whether you want to opt out of the 60-day lock. If you miss it and submit the form, you’re locked out for two months, and Namecheap support cannot override it for you.

Step 1: Check Current Lock Status via Terminal

Before clicking through the web dashboard, I always run a quick terminal check. A simple query shows whether the domain is client-locked, pending renewal, or tied up in an active transfer dispute.

Run whois against your domain to see its current EPP status codes:

whois example.com | grep -i "Domain Status"

If the domain is still locked at Namecheap, you’ll see client protection flags in the output:

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

That clientTransferProhibited flag means Namecheap’s registrar lock is active at the registry. We need to flip that status to ok before moving forward.

Step 2: Turn Off Domain Lock in the Namecheap Dashboard

Disabling the lock takes about thirty seconds inside your account:

1. Log in to Namecheap.
2. Click Domain List in the left sidebar.
3. Find your domain and hit the Manage button on the right.
4. Stay on the main Domain tab and scroll down to Status & Validity.
5. Find Domain Lock. If it’s active, you’ll see a green “LOCKED” badge.
6. Click the toggle to switch it to UNLOCK.

A confirmation modal will pop up. Confirm the unlock, and the badge will turn into a gray “UNLOCKED” status.

Step 3: Handle Privacy Protection (WhoisGuard)

Years ago, you had to disable WhoisGuard (now Namecheap Privacy) completely so your new registrar could scrape your administrative email address off public WHOIS. Under modern GDPR rules, that’s rarely required anymore. Almost all registrars now handle verification entirely through the EPP auth code.

That said, a few older registrars still insist on emailing the contact address listed in the public WHOIS data. If Namecheap Privacy is masking that email with a forwarding proxy that drops incoming messages, the confirmation email will bounce silently.

If your destination registrar explicitly requires raw WHOIS verification:

1. Go to the domain’s Manage screen.
2. Toggle the Namecheap Privacy switch to OFF.
3. Wait about five minutes for the change to show up in registry caches.

If your gaining registrar just asks for the EPP code (like Cloudflare, AWS Route 53, or Porkbun), leave Namecheap Privacy turned on. There’s no reason to expose your personal inbox to scraper spam if you don’t have to.

Step 4: Request and Retrieve the EPP Auth Code

The EPP Auth Code—sometimes called an Authorization Code, Auth-Info string, or Transfer Secret—is basically a one-time password proving you own the domain and authorize the transfer.

Here’s how to pull it from Namecheap:

1. On the domain’s Manage page, click the Sharing & Transfer tab.
2. Scroll down to the Transfer Out section near the bottom.
3. Make sure the domain lock toggle shows as unlocked.
4. Click the AUTH CODE button.
5. Pick an option on the quick exit survey (anything works, like “Consolidating services”).
6. Click Send Code.

Namecheap emails the auth code within a few minutes. Check the inbox tied to your primary Namecheap account for an email titled “Auth code for domain [yourdomain.com]”.

The code looks like a random string of characters and symbols:

# Example EPP Authorization Code
AuthCode=8kP$w9!mZqL#2024xT

Copy the string carefully. Watch out for accidental leading or trailing spaces when pasting it into your new registrar’s input box.

Step 5: Verify Registrar Status via Command Line

Don’t jump straight to your new registrar and submit the transfer request yet. Give Namecheap a few minutes to push the unlock command to the root registry. If the root servers still think the domain is locked when your new registrar pings them, the transfer will error out.

Run a direct WHOIS query against the registry operator to verify the lock has dropped:

whois -h whois.verisign-grs.com example.com | grep -i "Status"

For .com and .net domains, the authoritative Verisign response should look like this:

Domain Status: ok https://icann.org/epp#ok

Once you see Domain Status: ok, the registry has dropped all locks, and you’re clear to start the transfer. For other TLDs, you can look up the registry endpoint via the IANA Root Zone Database.

Preserving DNS Records and Zero Downtime During Transfer

The easiest way to break production during a registrar transfer is forgetting about your DNS provider. If your domain relies on Namecheap’s free BasicDNS or PremiumDNS, those nameservers stop resolving queries the moment the domain moves out of your Namecheap account.

To keep your site and mail running without a hitch, do this before transferring:

1. Back up your DNS zone: Go to the Advanced DNS tab in Namecheap and export or write down every single A, CNAME, MX, and TXT record.
2. Replicate records at your new DNS host: If you’re switching nameservers, create the exact same zone file on the destination nameservers before initiating the move. If you’re routing to external platforms, check our guide to point Namecheap domain to Hostinger nameservers without breaking email to keep mail alive.
3. Double-check mail authentication: If you run SPF, DKIM, or DMARC, make sure those TXT strings transfer accurately. See our walkthrough to configure SPF, DKIM, and DMARC in Namecheap DNS so your outbound messages don’t land in spam folders.
4. Handle subdomains: If you use external zone delegations, read how to delegate a subdomain to external nameservers in Namecheap DNS before pulling the plug.

Executing the Transfer at the Gaining Registrar

Once the lock is gone, the code is in your clipboard, and your DNS is replicated, you’re ready to place the transfer order:

1. Log in to your receiving registrar.
2. Head to their Domain Transfer page.
3. Type in your domain name and paste your EPP auth code.
4. Check out and pay (ICANN mandates adding a standard one-year registration renewal on transfers).

After payment, your new registrar fires an automated transfer request to the registry. Within 15–20 minutes, Namecheap sends an email with the subject line “Domain Transfer Request for [yourdomain.com]”.

You have two choices here:

• Let it sit: Do nothing, and the transfer automatically completes in five calendar days.
• Speed it up: Click the manual approval link inside that Namecheap email, log in, and hit Approve. That releases the domain immediately, cutting the transfer time from five days down to under twenty minutes.

Troubleshooting Common Namecheap Transfer Errors

If your transfer hits a wall, it’s almost always one of these two issues.

Error: “Invalid Authorization Code”

This usually happens when special characters get messed up by copy-pasting, or if you clicked “Send Code” a second time in Namecheap after submitting the request. Generating a new auth code invalidates the previous one immediately. If you’re getting this error, go back to Sharing & Transfer, request a fresh code, and retry with the newest string.

Error: “Domain is locked at the Registry”

If Namecheap shows the domain as unlocked but your new registrar insists it’s still locked, check your expiration date. If the domain has already expired and dropped into a redemption or grace period, you cannot transfer it out until you renew it through Namecheap first.

You can run dig against Namecheap’s nameservers to confirm the domain is still resolving properly:

dig @dns1.registrar-servers.com example.com +short

If you don’t get an answer back, check your Namecheap dashboard to see if your domain is expired or suspended.

Frequently Asked Questions

How long does it take to get the Namecheap Auth Code?

Usually between two and five minutes. If it hasn’t landed in your inbox after fifteen minutes, check your spam folder and verify which email address is listed as your primary account contact.

Will my website go down while the domain transfers?

Not if your nameservers stay active. However, if you are using Namecheap’s free BasicDNS, Namecheap stops serving your DNS records once the domain leaves their account. Switch to third-party nameservers (like Cloudflare or your hosting provider) before transferring to guarantee zero downtime.

Can I cancel the transfer after providing the Auth Code?

Yes. Until Namecheap hands over the domain at the registry level, you can cancel. Use the rejection link in the transfer notice email from Namecheap, or simply toggle the domain lock back on inside your dashboard to block the request.

Why is my Namecheap domain locked for 60 days?

ICANN enforces a mandatory 60-day freeze after new registrations, recent transfers, or changes to the registrant’s name or email. If you edited your registrant info and forgot to check the opt-out box, the 60-day lock is locked in stone—support cannot bypass it.

Next Steps

After your domain lands at the new registrar, verify all your DNS records and check that your SSL certificates are renewing properly. If you’re wiring this domain up to a new stack, follow our practical tutorial on how to deploy a web app on Hostinger with Namecheap DNS and StackPath CDN.