Companies House authentication code: the complete guide
By DormantFile · Updated 27 May 2026
The Companies House authentication code is the single most common blocker we see when someone tries to file their own dormant accounts. You only need it once a year, so it gets lost. New companies often don't realise they were sent one. Directors who took over an existing company sometimes never receive it at all.
This guide covers everything you need to know: what the code is, how to get one if you don't have it, where to find it if you do, what to do if it's lost, and how it fits with WebFiling, third-party filing software, and the new ECCTA identity verification rules.
What the authentication code actually is
A Companies House authentication code is a 6-character alphanumeric code — for example, A1B2C3 or K9X4P2. It is generated by Companies House and assigned to a single company.
It is not:
- Your Companies House WebFiling login (that's an email + password)
- Your HMRC Government Gateway login (separate system, separate credential)
- Your company UTR (10 digits, issued by HMRC)
- Your company registration number (8 digits, public, on every filing)
It is essentially a per-company password that proves the person filing has access to the registered office address. Without it, you cannot file annual accounts, confirmation statements, or any other document online — through WebFiling or through third-party software like DormantFile.
When do you need it?
You need the authentication code any time you file online:
- Annual dormant accounts (the main reason most people need it)
- The annual confirmation statement
- Change of registered office, director appointments and resignations, share allotments, PSC changes
- Filing through any approved filing software, not just WebFiling
You do not need it for the CT600 corporation tax return, which goes to HMRC and uses your Government Gateway credentials instead.
How to get an authentication code
There are two scenarios.
Scenario 1: You're a new company
The code is not sent automatically — you request it by creating a Companies House WebFiling account, adding your company, and asking for the code. It is then posted to the registered office address; allow up to 10 working days. The letter is plain, easy to miss, and looks a bit like junk mail.
If you formed your company through a formation agent (1st Formations, Companies Made Simple, Rapid Formations, etc.), the agent may have received the code on your behalf as part of their service. Check your formation paperwork or the agent's online portal before assuming it's lost.
Scenario 2: You're an existing company without a code
If you have never received one, or you took over a company and the previous director kept it, you can request a new code:
- Sign in to Companies House WebFiling (create an account if you don't have one)
- Add your company to the account using the company number
- Request the authentication code
- Companies House posts it to the registered office address — not to you personally, and not to your email
Allow up to 10 working days for the letter to arrive. There is no expedited option and there is no way to receive it electronically. This is intentional — the post-only policy is a security measure to ensure the person filing genuinely controls the registered office.
Where to find your code if you already have one
Common places people find it after thinking it was lost:
- The original Companies House welcome letter (sent shortly after incorporation)
- A subsequent letter sent after a new code was requested
- The formation agent's online dashboard or welcome email
- The previous director's records, if you took over the company
- An accountant's client file — if you've used an accountant in the past, they almost certainly have it
If you have used WebFiling or filing software in the past, the code itself is not stored or shown to you anywhere online. There is no "view my code" page. If it's lost, your only option is to request a replacement.
What if it's lost?
If you cannot find it anywhere, request a replacement through WebFiling (same process as Scenario 2 above). Requesting a new code invalidates the old one — so don't request a replacement if you might still find the original, as it will stop working the moment the new letter is generated.
The replacement is posted to the registered office address. If your registered office address is out of date, update it first — otherwise the code will go to the wrong place.
What if the registered office is wrong?
This is the genuine emergency case. If the registered office on the public register is no longer somewhere you can collect post from, you have a chicken-and-egg problem: you need the auth code to change the registered office online, but you can't get the auth code without access to the current registered office.
Two ways out:
- Change the registered office by paper form (AD01) — this can be done without an authentication code, by post. Slow (10+ working days), but it doesn't need the code. Once the new address is on the register, request the authentication code and it'll be posted to the new address.
- Have post forwarded from the old registered office address — if you trust the recipient there to forward it, this is much faster.
If neither is possible (e.g. the old registered office address is hostile, abandoned, or a formation agent whose contract you've ended), the paper AD01 is your only safe route.
Does the code expire?
No. The authentication code does not expire and is not tied to a specific director, accountant, or filing agent. It belongs to the company. If directors change, the code stays the same.
You can voluntarily request a new code at any time, which will invalidate the previous one. Useful if:
- You suspect the code has been shared with someone who no longer needs it
- You took over the company and want to start fresh
- You changed accountants and don't trust the previous one still has it
Keep it secure
Anyone with the authentication code can file documents on your company's behalf — including changing directors, allotting shares, or filing accounts you didn't approve. Treat it like a banking password:
- Don't email it in plain text where you don't need to
- Don't keep it in a shared spreadsheet without access controls
- Don't post it in Slack channels with broad membership
- If you share it with an accountant or filing service, rotate it after the engagement ends
When you file through DormantFile, your authentication code is transmitted directly to Companies House at the point of submission. For one-off filings it is used transiently and not retained. It is stored — encrypted at rest (AES-256-GCM) — only if you choose to save it, for example for annual autopilot, and you can remove it at any time from the company's settings. See our security page for the full detail on how filing credentials are handled.
ECCTA identity verification — does this change anything?
The Economic Crime and Corporate Transparency Act 2023 (ECCTA) introduces identity verification for directors. This is separate from the company authentication code and does not replace it.
- The authentication code authorises a filing on behalf of a company
- ECCTA identity verification authorises a person to be a director or PSC
You will need both. The code continues to work as before — ECCTA adds a person-level check on top, not a replacement of the company-level credential.
How DormantFile handles it
When you file dormant accounts through DormantFile:
- We collect the authentication code at the point of filing
- We transmit it directly to Companies House's filing API
- For a one-off filing, we do not retain it after submission — you enter it fresh next time
- If you choose to save it — for example to enable annual autopilot — it is stored encrypted at rest (AES-256-GCM), never displayed again, and never logged
Saving the code is always your choice, never the default. You can see whether a code is stored and remove it at any time from the company's settings — removing it deletes it immediately and turns autopilot off.
Common scenarios
"I'm filing for the first time and never got a letter." The code isn't sent automatically — request it through WebFiling and the letter usually arrives within 10 working days. If you formed the company through an agent, check their portal first.
"My company is 4 years old and I've never filed online before." Either the original code letter is in old paperwork, your accountant has it, or it was lost. Request a replacement.
"I have multiple dormant companies — do they share a code?" No. Each company has its own authentication code. If you manage multiple companies, each one needs its own.
"The previous director won't give me the code." Request a new one. It will be posted to the registered office, which (assuming you've updated the directors and the registered office) is now your address.
"I need to file today and the code hasn't arrived." There is no expedited delivery. If the deadline is imminent and you're at risk of a late filing penalty, file as soon as the code arrives — the penalty starts the day after the deadline and continues to escalate. You cannot file without the code, but you can request a replacement immediately to start the 10-working-day clock.
Related reading
- What is a Companies House authentication code? — the short version
- How to file dormant company accounts — full filing walkthrough
- Companies House late filing penalties — what happens if you miss the deadline waiting for the code
- ECCTA identity verification for directors — the separate person-level check