Companies House authentication code: the complete guide

By DormantFile · Updated 27 May 2026

The Companies House authentication code is the single most common blocker we see when someone tries to file their own dormant accounts. You only need it once a year, so it gets lost. New companies often don't realise they were sent one. Directors who took over an existing company sometimes never receive it at all.

This guide covers everything you need to know: what the code is, how to get one if you don't have it, where to find it if you do, what to do if it's lost, and how it fits with WebFiling, third-party filing software, and the new ECCTA identity verification rules.

What the authentication code actually is

A Companies House authentication code is a 6-character alphanumeric code — for example, A1B2C3 or K9X4P2. It is generated by Companies House and assigned to a single company.

It is not:

Your Companies House WebFiling login (that's an email + password)
Your HMRC Government Gateway login (separate system, separate credential)
Your company UTR (10 digits, issued by HMRC)
Your company registration number (8 digits, public, on every filing)

It is essentially a per-company password that proves the person filing has access to the registered office address. Without it, you cannot file annual accounts, confirmation statements, or any other document online — through WebFiling or through third-party software like DormantFile.

When do you need it?

You need the authentication code any time you file online:

Annual dormant accounts (the main reason most people need it)
The annual confirmation statement
Change of registered office, director appointments and resignations, share allotments, PSC changes
Filing through any approved filing software, not just WebFiling

You do not need it for the CT600 corporation tax return, which goes to HMRC and uses your Government Gateway credentials instead.

How to get an authentication code

There are two scenarios.

Scenario 1: You're a new company

When you incorporate a company, Companies House posts the authentication code to the registered office address automatically — usually within 5 working days of incorporation. The letter is plain, easy to miss, and looks a bit like junk mail.

If you formed your company through a formation agent (1st Formations, Companies Made Simple, Rapid Formations, etc.), the agent may have received the code on your behalf as part of their service. Check your formation paperwork or the agent's online portal before assuming it's lost.

Scenario 2: You're an existing company without a code

If you have never received one, or you took over a company and the previous director kept it, you can request a new code:

Sign in to Companies House WebFiling (create an account if you don't have one)
Add your company to the account using the company number
Request the authentication code
Companies House posts it to the registered office address — not to you personally, and not to your email

Allow up to 5 working days for the letter to arrive. There is no expedited option and there is no way to receive it electronically. This is intentional — the post-only policy is a security measure to ensure the person filing genuinely controls the registered office.

Where to find your code if you already have one

Common places people find it after thinking it was lost:

The original Companies House welcome letter (sent shortly after incorporation)
A subsequent letter sent after a new code was requested
The formation agent's online dashboard or welcome email
The previous director's records, if you took over the company
An accountant's client file — if you've used an accountant in the past, they almost certainly have it

If you have used WebFiling or filing software in the past, the code itself is not stored or shown to you anywhere online. There is no "view my code" page. If it's lost, your only option is to request a replacement.

What if it's lost?

If you cannot find it anywhere, request a replacement through WebFiling (same process as Scenario 2 above). Requesting a new code invalidates the old one — so don't request a replacement if you might still find the original, as it will stop working the moment the new letter is generated.

The replacement is posted to the registered office address. If your registered office address is out of date, update it first — otherwise the code will go to the wrong place.

What if the registered office is wrong?

This is the genuine emergency case. If the registered office on the public register is no longer somewhere you can collect post from, you have a chicken-and-egg problem: you need the auth code to change the registered office online, but you can't get the auth code without access to the current registered office.

Two ways out:

Change the registered office by paper form (AD01) — this can be done without an authentication code, by post. Slow (10+ working days), but it doesn't need the code. Once the new address is on the register, request the authentication code and it'll be posted to the new address.
Have post forwarded from the old registered office address — if you trust the recipient there to forward it, this is much faster.

If neither is possible (e.g. the old registered office address is hostile, abandoned, or a formation agent whose contract you've ended), the paper AD01 is your only safe route.

Does the code expire?

No. The authentication code does not expire and is not tied to a specific director, accountant, or filing agent. It belongs to the company. If directors change, the code stays the same.

You can voluntarily request a new code at any time, which will invalidate the previous one. Useful if:

You suspect the code has been shared with someone who no longer needs it
You took over the company and want to start fresh
You changed accountants and don't trust the previous one still has it

Keep it secure

Anyone with the authentication code can file documents on your company's behalf — including changing directors, allotting shares, or filing accounts you didn't approve. Treat it like a banking password:

Don't email it in plain text where you don't need to
Don't keep it in a shared spreadsheet without access controls
Don't post it in Slack channels with broad membership
If you share it with an accountant or filing service, rotate it after the engagement ends

When you file through DormantFile, your authentication code is transmitted directly to Companies House at the point of submission and not stored in our database. See our security page for the full detail on how filing credentials are handled.

ECCTA identity verification — does this change anything?

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) introduces identity verification for directors. This is separate from the company authentication code and does not replace it.

The authentication code authorises a filing on behalf of a company
ECCTA identity verification authorises a person to be a director or PSC

You will need both. The code continues to work as before — ECCTA adds a person-level check on top, not a replacement of the company-level credential.

How DormantFile handles it

When you file dormant accounts through DormantFile:

We collect the authentication code at the point of filing — not in advance
We transmit it directly to Companies House's filing API
We do not store it in our database after submission
You enter it fresh each year for each company

This is why we ask for it every time and why we don't have a "save my code" toggle. Storing filing credentials is a category of risk we choose not to take on.

Common scenarios

"I'm filing for the first time and never got a letter." The code letter usually arrives within 5 working days of incorporation. If it's been longer, request a replacement through WebFiling.

"My company is 4 years old and I've never filed online before." Either the original code letter is in old paperwork, your accountant has it, or it was lost. Request a replacement.

"I have multiple dormant companies — do they share a code?" No. Each company has its own authentication code. If you manage multiple companies, each one needs its own.

"The previous director won't give me the code." Request a new one. It will be posted to the registered office, which (assuming you've updated the directors and the registered office) is now your address.

"I need to file today and the code hasn't arrived." There is no expedited delivery. If the deadline is imminent and you're at risk of a late filing penalty, file as soon as the code arrives — the penalty starts the day after the deadline and continues to escalate. You cannot file without the code, but you can request a replacement immediately to start the 5-working-day clock.