When a gTLD transfer request is initiated, an authorisation email is sent to the registrant contact of that domain.
The registrant then has five days to respond to that email in order for the transfer to proceed.
The existing registrar may also send an email to the registrant to confirm the authenticity of the transfer.
This registrar then has to approve the transfer away in order for the transfer to complete.
Once the transfer is complete a confirmation email is sent to the registrant contact with their new authorisation information.
A password is not needed to initially request the transfer.