WhatsApp Tightens Account Security With Passkeys, Stronger 2SV

WhatsApp is rolling out a set of account security upgrades that could change how hundreds of millions of users protect their accounts. The Meta-owned messaging platform announced on Tuesday that it is expanding passkey support, replacing its six-digit two-step verification PIN with a proper password, and testing a new caller context feature for Android users. The changes arrive as WhatsApp pushes users toward more robust authentication methods, with the company saying more than 1 billion individuals now rely on a passkey to log in to their WhatsApp accounts.

Passkeys Expand to Multi-Device

WhatsApp says users can now add more than one passkey to their account. That means someone who uses the app on both an iOS device and an Android handset can set up a passkey on each platform, rather than being limited to a single credential. The move is aimed at people who switch between devices regularly, making it easier to sign in without falling back to less secure methods like SMS codes.

The feature builds on WhatsApp's earlier passkey rollout, which let users log in using biometric authentication such as fingerprints or facial recognition. By allowing multiple passkeys, the company is acknowledging that a single device-based credential is not always practical for users who split their time across ecosystems.

Two-Step Verification Moves Beyond Six Digits

The bigger change comes to two-step verification. Previously, WhatsApp's 2SV relied on a six-digit PIN that users had to remember and enter when registering their phone number on a new device. That PIN is now being upgraded to a full password. According to WhatsApp, the password can be longer and can include alphanumeric and special characters, giving users more flexibility to create something harder to guess.

This shift addresses a long-standing criticism of six-digit PINs: they offer a limited keyspace and can be vulnerable to brute-force attacks if an attacker manages to obtain a copy of the account's encrypted data. A longer, passphrase-style password is inherently stronger, though it also places more responsibility on users to remember it.

Caller Context Arrives on Android

For Android users, WhatsApp is introducing a feature that provides more information about incoming calls from numbers that are not saved in their contacts. When such a call arrives, the app will show the caller's country of origin and whether that person belongs to any WhatsApp groups the user is also part of.

The feature is designed to give users a moment of context before they answer. In a statement, WhatsApp said: “Scammers rely on urgency – now you can take a beat with some more info before answering.”

Scammers rely on urgency – now you can take a beat with some more info before answering.

— WhatsApp, in the announcement

The tool is currently limited to Android, and it is unclear when iOS users might see it. It follows a broader push by WhatsApp to reduce spam and scam calls, which have become a persistent problem on the platform.

A Pattern of Security Improvements

The new features arrive about two weeks after WhatsApp introduced Scam Alert, an optional tool that uses AI to flag suspicious messages from non-contacts. That feature was part of a series of updates aimed at cutting down on fraud and phishing attempts.

WhatsApp has also been working on other privacy-related changes. The company recently rolled out a username feature designed to bolster phone number privacy, allowing users to share a unique username instead of revealing their phone number. Separately, WhatsApp disclosed file spoofing and arbitrary URL scheme vulnerabilities earlier this year, and a flaw in an Adobe extension with 300 million installs enabled WhatsApp data theft.

Key Numbers Behind the Update

• More than 1 billion individuals now use a passkey to log in to WhatsApp accounts.
• 2SV is upgraded from a six-digit PIN to a full password with alphanumeric and special characters.
• The caller context feature is currently Android-only.

What This Means for Your Account

For the average WhatsApp user, these changes represent a meaningful shift in how account security works. The move to full passwords for 2SV is a clear improvement over the old six-digit PIN, but it also means users need to think carefully about creating a strong password and storing it somewhere safe. Reusing a password from another service is a risk, since a leak on one platform could compromise a WhatsApp account.

The expansion of passkeys is also worth paying attention to. Passkeys are generally considered more resistant to phishing than traditional passwords because they are tied to a specific device and use biometric verification. Adding multiple passkeys makes this option more practical for people who genuinely use both iOS and Android phones, which could lead to wider adoption.

The caller context feature, while still in its early stages, could help Android users avoid scam calls. By showing a caller's country and any shared group membership, WhatsApp is giving users a small but useful clue about whether a call is legitimate. This is particularly valuable because scammers often spoof numbers or use international callers to create a sense of urgency.

Each of these updates is part of a larger pattern at WhatsApp: moving away from weak, static credentials and toward more dynamic, context-aware security. Whether the company can convince its massive user base to embrace these changes—especially the move from a simple PIN to a full password—remains an open question. But the direction is clear, and it could set a standard for other messaging apps that still rely on SMS-based verification.