How to get a replacement Companies House authentication code

GOV.UK describes the company authentication code as a six digit alphanumeric code issued by Companies House to each company, and treats it as the online equivalent of a company officer's signature. It is what proves to the registrar that a filing submitted through WebFiling came from someone the company trusts, rather than from a stranger who happened to look up the company number on the public register.

The code belongs to the company, not to you. A director of three companies holds three separate authentication codes, one per company, and changing one has no effect on the others. This is the first place people go wrong: they assume the code is attached to their login, so they try to recover it by resetting a password, and nothing happens because the two things are unrelated.

It is worth separating four objects that all get called 'my Companies House details'. The company number is public and searchable on the Find and update company information service. Your GOV.UK One Login email and password get you into WebFiling. Your Companies House personal code is an eleven-character code issued to you personally once you have verified your identity. The authentication code is the company's. Losing any one of them does not affect the others, and each has its own recovery route.

GOV.UK's warning about the code is blunt: anyone who knows it is able to change your company's details online. That includes moving the registered office, appointing and removing officers, and filing a confirmation statement. It is why the code is posted rather than emailed, and why Companies House will not read it out to a caller — including a caller who can answer every security question correctly.

The corollary is a fraud rule you should treat as absolute. GOV.UK's own guidance on the code states that Companies House will never request it by phone, and the code is never sent by email in either direction. So any message asking you to 'confirm', 'renew' or 're-enter' your authentication code is a fraud attempt, regardless of how convincing the branding is, and so is any caller who offers to read it back to you for verification. The safe response is always the same: close the message, and reach Companies House by typing the GOV.UK address or ringing the published number.

Finally, the code does not gate everything. Searching the register, downloading filed accounts and checking when a confirmation statement is next due are all free and need no code at all. When Companies House moved WebFiling sign-in to GOV.UK One Login it also carved out one exception, saying you would still be able to file a charge — a mortgage — document without connecting your account to One Login.

Start on the public register, not in WebFiling. Look the company up on Companies House's Find and update company information service and check two things: the exact company number, and the registered office address currently on record. The code is posted to that address, so if the address on the register is wrong or unreachable, requesting the code first and worrying about the address afterwards wastes the ten working days you cannot spare.

Then sign in to WebFiling. From 13 October 2025 this runs through GOV.UK One Login: Companies House's announcement says that when you sign in you will be prompted to connect your WebFiling account to a One Login, and that you will not be able to access WebFiling without connecting. If you have never had a One Login, you create one with an email address and a phone or authenticator app for two-step verification. The separate guide on setting up One Login covers that in full.

There is a trap here for companies where several people shared one WebFiling login. Companies House states that only one person can connect each WebFiling account to their GOV.UK One Login, and that anyone else who shared access will need to create their own One Login using a different email address. In practice this means the first person to connect keeps the account and everyone else has to start again — so agree who that will be before anyone signs in.

Once inside WebFiling, choose the option to request an authentication code. You are asked whether the code is for a company or an LLP, where it was formed — England and Wales, Scotland or Northern Ireland — and for the registered number. Enter the number exactly as it appears on the register, including leading zeros and the SC or NI prefix where there is one. A mistyped number posts a live authentication code to somebody else's registered office.

What you get on screen is a confirmation that the request has been accepted, not a code. Nothing will arrive by email, that day or any other. If a message purporting to contain the code lands in your inbox afterwards, it did not come from Companies House — and assume whoever sent it knows you have just made the request, because a company's filing dates are public and the pattern is easy to target. Screenshot the confirmation screen before you close it.

You do not need to be a director to make the request, and Companies House does not ask you to prove you are one, because the security control is the destination address rather than the requester. That is a deliberate design: the code goes to the address the company itself put on the public register, so the only person who can collect it is someone with access to that address.

Keep a note of the date you made the request, and of the address it was going to. If nothing has arrived after ten working days you will want to tell the Companies House contact centre exactly when the request went in, and whether the registered office on the register changed in the meantime — a code posted the day before an address change followed the old address, and nobody will work that out for you. The same note is what turns a weak late filing appeal into a documented one.

GOV.UK's guidance on company authentication codes gives one timescale and one only: the code is sent by post to the company's registered office and it can take up to 10 working days to arrive. There is no expedited service, no counter collection and no fee to pay for speed. Companies House's main office in Cardiff is not open to the public, so there is nowhere to turn up in person and ask.

Convert that into calendar days before you plan around it. Ten working days spans two full weekends, so a request made on a Monday morning is not overdue until roughly a fortnight later, and a bank holiday adds another day. A request made in the week before Christmas or Easter can easily run to three calendar weeks. Companies House also warns, in its late filing penalty guidance, that it cannot accept delays in transit as a reason to appeal a penalty — so the postal risk sits with you, not with the registrar.

If you genuinely cannot use the registered office, GOV.UK offers one alternative and it is the most useful sentence in the whole guidance: if you cannot access your company's registered office address, Companies House can send your authentication code to your home address instead. That is the escape hatch for a director whose accountant holds the registered office, whose office has been vacated, or who is abroad.

The home address used for this purpose is a delivery instruction, not a filing. You are not changing the company's registered office, you are not adding a service address to the register, and nothing about it is published — the address only exists to get one envelope to you. If you do want the registered office itself changed, that is a separate filing and it is dealt with in the next section.

When the ten working days have passed and nothing has arrived, ring the Companies House contact centre on 0303 1234 500, open Monday to Friday from 8:30am to 6pm. They will not read the code out, because that is the one thing the system is built to prevent. What they can do is confirm the registered office they hold, confirm whether a request is on the system, and re-issue the code so a fresh letter goes out.

Before you make that call, check the physical route the letter takes at your end. A serviced office reception, a shared post tray in a building with several tenants, a landlord who forwards mail weekly, or a mailbox provider that scans envelopes and discards the originals are all common reasons a code arrives and is never seen. Ask whoever handles the post to look for a Companies House envelope specifically, because a plain letter with no invoice inside is exactly what gets set aside. Companies House has done its part when it posts the letter; the last fifty metres are yours.

This is the version of the problem that has no clean answer, and it is common. The registered office on the public register is a formation agent, an accountant or a virtual office provider. The retainer has ended, an invoice is in dispute, or the provider has simply stopped responding. Companies House will post the authentication code there because that is the address the company itself put on the register, and the person who opens it is not you.

There is a legal standard for that address, and it may not be met. Under the Economic Crime and Corporate Transparency Act 2023 a company must have an 'appropriate address' as its registered office. Companies House explains that an address is appropriate if, in the ordinary course of events, a document delivered there by hand or post would be expected to come to the attention of a person acting on behalf of the company, and delivery there is capable of being recorded by obtaining an acknowledgement. A bare PO Box does not qualify, and has not since 4 March 2024.

The registrar has teeth on this. Companies House states that where it decides an address is not appropriate, it can move the company to a default address, after which the company has 28 days to provide an appropriate address with evidence that it is entitled to use it — and that failure to do so can lead to strike-off proceedings. An address at which the company's own statutory post never reaches anyone acting for the company is, on its face, exactly the situation that rule was written for.

That leaves the practical catch-22. Changing the registered office through WebFiling requires the authentication code, and the authentication code is posted to the registered office you are trying to change. There are only two ways out. The first is the home-address route in the previous section: ask for the code to be sent to a director's home, then use it to file the address change online. The second is to change the registered office on paper using form AD01, which is signed by an officer rather than authenticated by the code.

The paper route has a specific failure mode worth checking first. If the company is enrolled in Companies House's PROOF service, paper versions of the protected forms — which include officer appointments and terminations, changes to officers' details and changes of registered office — are rejected and returned to the registered office address. That is the whole point of PROOF, and it is an excellent anti-fraud control that turns into a locked door when the person who needs to file is the legitimate director.

Alongside all of that, deal with the relationship. A regulated accountant, solicitor or chartered secretary is subject to a professional body with a complaints process. A formation agent that holds itself out as an Authorised Corporate Service Provider has had to register with Companies House and be supervised by a UK anti-money-laundering supervisory body to do so, which gives you two places to complain rather than one. Raise it in writing, keep the correspondence, and tell the Companies House contact centre if the company's statutory post is being withheld.

Since 18 November 2025 the company authentication code is no longer sufficient on its own. Identity verification became a legal requirement on that date for directors and people with significant control, having been available voluntarily from 8 April 2025. Companies House's own campaign material is careful to say that 18 November 2025 started a twelve-month transition period rather than a single cliff-edge deadline, with existing directors and PSCs having individual due dates within that window.

What you receive when you verify is a Companies House personal code. GOV.UK describes it as an eleven-character code given to a person once they have verified their identity, and stresses that it is personal to you and not to your company. You verify once and reuse the same personal code across every appointment you hold, at every company. That is the opposite of the authentication code, which is one per company and shared by whoever files for it.

Where you find the personal code depends on how you verified. If you verified through GOV.UK One Login, sign in to Companies House and look under 'Manage account'; GOV.UK adds that people verifying after 8 July 2026 were also sent the code by email. If an Authorised Corporate Service Provider verified you, the code was emailed to the address that firm gave for you, which is worth knowing if you have since changed accountants. GOV.UK also explains what to do if your details do not match the company record — usually a wrong date of birth, which is corrected through WebFiling.

The two codes now meet in the confirmation statement. GOV.UK's confirmation statement guidance says you must provide the Companies House personal code for each director and tick a statement confirming that each of them has verified their identity, and that Companies House will not accept the statement until all directors have verified. People with significant control have their own requirement and their own window, described in the guidance as fourteen days depending on the circumstances. So a company can hold a perfectly good authentication code and still be unable to file.

There are two verification routes and both meet the same standard. GOV.UK One Login is free and runs through the One Login app, a set of online security questions, or an in-person check at a participating Post Office. An Authorised Corporate Service Provider — an accountant, solicitor or formation agent registered with Companies House and supervised for anti-money-laundering — will do it for you and may charge a fee. Companies House states that both routes must meet equivalent assurance standards, so the choice is one of convenience and cost rather than of rigour.

It does not stop with directors and PSCs. Companies House has said that from November 2027 further groups — including people who file documents on behalf of companies — will be brought into the requirement, with at least six months' notice before that happens. If you are a bookkeeper, office manager or company secretary who files but holds no appointment, that is the change to watch, because it is the point at which holding the company's authentication code stops being enough on its own. The sensible preparation is to verify early rather than in the same month as a deadline, since verification is free through GOV.UK One Login and only has to be done once.

The deadline that generates most of these searches is the confirmation statement. Section 853A of the Companies Act 2006 requires every company to deliver one before the end of the period of 14 days after the end of each review period, and defines the review period as twelve months from incorporation and then twelve months from the end of the previous one. GOV.UK puts it more plainly: every company, including dormant and non-trading companies, must file a confirmation statement at least once every year.

The fee is £50 filed online and £110 on paper, and GOV.UK notes that the annual fee is payable once per twelve-month payment period however many statements you file within it. That matters if you are considering filing early to reset the review period, which the guidance expressly allows — file before the due date and you choose a new confirmation statement date, with the next review period starting the day after.

If the confirmation statement is not filed, GOV.UK's guidance says Companies House may issue a financial penalty and the company may be struck off the register, and refers to penalties of up to £5,000. That is a different mechanism from the late accounts penalties below: it is discretionary rather than automatic, it attaches to a failure the registrar has to decide has occurred, and the strike-off threat rather than the money is usually what forces the issue.

Late accounts are a separate and more mechanical regime. Companies House publishes a fixed scale of late filing penalties by how late the accounts are, and doubles the penalty where accounts are filed late in two successive financial years beginning on or after 6 April 2008. Those are civil penalties against the company; failing to file at all is also an offence for which directors can be prosecuted personally.

Strike-off is the outcome people underestimate. Where a company appears not to be carrying on business or in operation, the registrar can begin the process of striking it off, with notices published in the Gazette; interested parties can object to the dissolution, and a struck-off company can be restored, but restoration is slower, more expensive and more disruptive than filing on time. Bank accounts freeze, assets pass to the Crown as bona vacantia, and directors spend months undoing it.

Work backwards from your own dates rather than from the general rule. A company with a confirmation statement due on 20 September that discovers a missing code on 1 September has, on GOV.UK's ten-working-day figure, a letter due around 15 September — tight but workable, provided identity verification is done in the same fortnight. The same discovery on 10 September does not work, and that is the point at which the fallbacks in the next section stop being optional.

The first fallback is paper. The authentication code exists for online filing — GOV.UK's guidance is titled and framed that way — and paper forms are instead signed by a company officer. A confirmation statement can be filed on form CS01 by post for £110 rather than £50, and Companies House publishes the equivalent paper forms for officer changes and address changes. Post it to Companies House, Crown Way, Cardiff CF14 3UZ, whichever part of the UK the company is registered in.

Check one thing before you rely on that. If the company is enrolled in the PROOF service, Companies House will reject the protected paper forms and return them to the registered office address — the very address you may be unable to reach. PROOF protects officer appointments, terminations, changes to officers' details and registered office changes, so it bites hardest in exactly the situation where the paper route looked like the answer.

Second, use the phone properly. The Companies House contact centre on 0303 1234 500 is open Monday to Friday, 8:30am to 6pm, and closed on UK bank holidays. It will not give you the code, but it will confirm the registered office held on record, confirm whether a code request has been raised, re-issue the letter, and tell you the date the next confirmation statement is due. Have the company number in front of you; the call is much shorter with it.

Third, do not stop the clock by waiting. If the identity verification side is incomplete, get every director's personal code sorted while the letter is in the post, because GOV.UK is explicit that the confirmation statement will not be accepted until all directors have verified. If the registered office is wrong, deal with that as its own filing rather than as a byproduct of the code request. And if the accounts are also close to their deadline, remember that they run on a separate clock with a separate and automatic penalty scale — the two problems can be solved in the same week, but they are not the same problem.

Fourth, if a penalty does land, appeal it properly rather than ignoring it. Companies House publishes an appeal route for late filing penalties and says it will suspend recovery action while an appeal is being considered, so there is no need to keep chasing. It is equally clear that delays in transit are not accepted as a reason to appeal — which means 'the code did not arrive in time' is a weak appeal on its own, and a much stronger one when supported by dates showing when the request was made and what went wrong.

Fifth, take strike-off warnings seriously the day they arrive. A first Gazette notice is not the end of the process, and objecting to a proposed dissolution is far easier, cheaper and faster than restoring a company that has already been dissolved. If a strike-off notice and a missing authentication code turn up in the same fortnight, the notice is the more urgent of the two: deal with the objection first, then carry on chasing the code. A company that has been struck off cannot file anything at all until it is restored, so every other problem on this page becomes unfixable the moment dissolution goes through.

Once the letter arrives, change the code before you file anything. GOV.UK says you can sign in to WebFiling to change or cancel your code, and that you can change it to something more memorable — while adding the obvious caution not to make it easy to guess. It also reminds you that if you change the code you must tell everyone else who files online for the company, because they are all using the same one.

Change it whenever someone with access leaves. GOV.UK's guidance says to change the code if it is compromised or if people authorised to use it leave the company, and that advice is worth following literally for a departing bookkeeper, an accountant whose retainer has ended, or a former director. The code is a company credential shared by everyone who files, so it should be rotated on the same events that would prompt you to change a shared office alarm code.

Store it somewhere that survives a change of laptop, a change of accountant and a change of address. In practice this means a password manager entry against the company name — not a note in an email thread, and not a photograph of the letter in a camera roll. Record the company number, the authentication code and, separately, each director's personal code, because you will be asked for the personal codes every year at confirmation statement time.

Enrol in PROOF if the company is not already. Companies House offers it free and it prevents fraudulent paper filings against the company record by rejecting paper versions of the protected forms. The trade-off, as this page has already noted, is that PROOF closes the paper fallback for exactly those forms — which is a reason to keep the authentication code recoverable rather than a reason to avoid the protection.

Turn on the Follow service as well. Companies House describes it as a free service giving email alerts of transactions on a company record, and it is the earliest possible warning that someone has moved your registered office or appointed a director you have never heard of. Alongside it, keep Companies House email reminders switched on for the company, so filing deadlines arrive in your inbox rather than as a penalty notice at an address you may no longer use.

Finally, treat unsolicited contact about the code as fraudulent by default. Companies House states it will never contact you by email or telephone asking for secure information, and the code is never sent by email. If something claiming to be Companies House asks you to confirm a code, pay a fee to avoid a strike-off, or renew a registration, close it and reach Companies House by typing the GOV.UK address or ringing 0303 1234 500. If you have already been caught, tell Companies House and report it as fraud.