WhatsApp Strengthens Two-Step Verification, Passkeys and Caller Security
WhatsApp adds stronger two-step verification, multiple passkeys and richer unknown-caller details as Meta expands account security on iOS and Android.
Summary
Meta-owned WhatsApp on Tuesday, August 25, 2026, began launching stronger two-step verification that lets users replace the existing six-digit PIN with a longer alphanumeric password containing special characters. The extra credential protects accounts after a one-time passcode is compromised. Users can also register multiple passkeys, useful across iOS and Android. Supported since 2024, passkeys authenticate through Face ID or a fingerprint, remove phishable username and password combinations, and make remote takeover harder because an attacker needs physical access to the device storing the key.
Android users will receive more context for calls from non-contacts, including whether a number comes from another country and whether the caller shares any groups with them. The release comes as WhatsApp, Signal and Telegram seek simpler defenses against increasingly sophisticated phishing and hacking. WhatsApp introduced usernames in late June, allowing profiles to be shared without revealing phone numbers. In late May, Meta launched the WhatsApp Plus subscription with profile customization, super reactions and story insights, alongside Plus plans for Instagram and Facebook.
Positives
- Longer alphanumeric passwords with special characters strengthen WhatsApp’s previous six-digit two-step verification PIN.
- Multiple passkeys let people authenticate the same WhatsApp account across iOS and Android devices.
- Face ID and fingerprint passkeys reduce dependence on username and password combinations vulnerable to phishing.
- Android caller context identifies international numbers and shared groups before users answer calls from non-contacts.
- Late June usernames let WhatsApp users share profiles without exposing their phone numbers.
Risks & concerns
- Phishing and hacking attempts have become increasingly sophisticated across WhatsApp and competing messaging platforms.
- Six-digit PINs offer weaker protection against guessing than the new optional alphanumeric credentials.
- Unknown-caller country and shared-group details are currently limited to Android users.
- Physical access to a device storing a passkey remains the route an attacker would need to compromise passkey authentication.