Just in case you did not know: if you transfer to a different registrar, you will not lose the extra years of registration. You can confirm the expected expiration date of 2027 at lookup.icann.org.
I did not know that. But how do you do it? And where to find a list of reputable registrars (which seems the rarest of species)?
https://www.reddit.com/r/homelab/comments/116j7iq/fyi_namech...
https://www.bleepingcomputer.com/news/security/namecheaps-em...
Maybe I'm not paranoid enough, but I think there would be too much noise if every company blasted out emails to all customers any time there was ANY security failure, including failures that do not expose customer data... Sure, they should follow up on your who got phishing emails, but I don't see a need to email every customer.
I've had no issues with NameCheap, but I just register domains, no other fancy services.
I currently use porkbun and namesilo with very few issues so far (about 3 years). You will need to unlock your domain and get an authorization code (EPP Key) from Gandi and then go to your new registrar and select Transfer Domain. Its fairly straight forward.
What happened that drove you away?
For me the purpose of a registrar is to register a domain. Porkbun might have other capabilities, but for this purpose it was wonderfully singleminded for me.
1. They routinely fail to auto renew domains despite correct billing details and auto renew being on (I lost some domains to this).
2. They support premium domains, so you can be struck by lightning and randomly have the price of your domains dramatically jacked up (had to drop a domain due to this).
3. The name (NameCheap) no longer checks out, they are not cheap anymore.
They stopped being good about 2 years ago.
Do you have an example of this as it is against ICANN's rules IIRC.
The only instances I have seen about this were the posts here on HN when someone didn't read the registration price being at a discount compared to the renewal price thereafter.
If there is of course a legitimate instance of reclassification into a premium domain after the fact, you have a big case on your hands.
But I remember that I specifically spent effort/time to pick a name that was not marked as premium and double/triple checked before registering. Then about 3 months after I had registered it, it all of a sudden showed as premium in my account.
From my perspective it doesn't really matter much if they made it premium after I had registered it or if it was always premium and they hid that fact and gave me an invisible discount. The end result is the same.
Any registrar that receives the transfer will automatically have the extended expiration date. (The expiration date is actually tracked at the registry.)
For reputable registrars, I think you could gather a list from HN comments and then "do your own research" to whittle down the list.
CF has the most serious product out of any of them, and they sell domains at-cost as a loss-leader to get you in.