WhatsApp Adds Multiple Passkeys and Stronger Two-Step Verification

WhatsApp multiple passkeys and stronger two-step verification arrived together as part of an account security update Meta announced this week. The update covers three separate features: passkeys that can now be registered per device, a two-step verification (2SV) password option that replaces the six-digit PIN, and expanded caller information for Android users.

Passkeys let a user sign in with a fingerprint, Face ID, or device screen-lock code instead of typing credentials. Until this update, WhatsApp supported only one passkey per account, which caused friction for people who owned both an iPhone and an Android phone. Meta said more than 1 billion people already use a passkey to log into WhatsApp, and the new multi-device option is managed from Settings > Account > Passkeys.

WhatsApp's two-step verification previously asked users to set a six-digit numeric PIN, required again if a phone number is re-registered on the app. A six-digit PIN offers only a limited number of possible combinations (roughly a million, by simple estimate), and predictable choices like "123456" make brute-force or social-engineering attacks easier. WhatsApp's own announcement singled this out, writing: "If you've been using '123456,' this is your sign to upgrade."

The new option lets users set a longer, alphanumeric password with special characters instead. Two-step verification is designed as a backup layer that blocks account takeover even if an attacker has already obtained a one-time SMS passcode, so a harder-to-guess password closes a real gap that phishing and SIM-swap attempts have historically exploited.

• Any WhatsApp user can switch two-step verification from a PIN to a full password immediately.
• Users who run WhatsApp on both an iOS and an Android device benefit most from multiple passkeys, since each device can now hold its own passkey.
• Android users specifically gain the new non-contact call-context feature; it has not been extended to iOS in this rollout.

Alongside authentication changes, WhatsApp added a scam-prevention feature limited to Android for now. When a call arrives from a number outside a user's contact list, the app displays extra context before the call is answered, including whether the number originates from a different country and whether the caller shares any WhatsApp groups with the recipient.

WhatsApp framed the feature as a way to counter urgency-based scam tactics, saying: "Scammers rely on urgency, now you can take a beat with some more info before answering." The company did not say when, or if, the feature will reach iOS.

This week's changes extend a string of anti-fraud features WhatsApp has shipped through 2026. In January, the company rolled out "Strict Account Settings," an Apple Lockdown-style mode aimed at protecting journalists and other high-risk individuals from spyware and targeted attacks. In March, Meta added warnings for suspicious device-linking requests, a tactic attackers use to hijack accounts by tricking victims into sharing a linking code or scanning a malicious QR code.

Earlier in August 2026, WhatsApp introduced an optional "Scam Alert" feature in limited beta that runs a local machine learning model on-device to flag likely scam contact from non-contacts. Meta says WhatsApp now serves more than 3 billion people in over 180 countries, making incremental, opt-in defenses like these relevant to a very large and diverse user base rather than a narrow segment.

1. Open Settings > Account > Passkeys in WhatsApp on each device to add a device-specific passkey.
2. If two-step verification is enabled, replace any existing six-digit PIN with a longer alphanumeric password.
3. MSPs managing BYOD fleets should flag this change in security awareness material, since many users still rely on the weaker PIN by default.
4. Android users should review new call-screen context before answering unknown numbers, but should not treat it as a guarantee against spoofed numbers.

The update removes a weak six-digit PIN as the strongest available two-step verification option and lets multi-device users rely on passkeys instead of falling back to shared or weaker credentials.

Security: Replacing a six-digit PIN (roughly a million possible combinations, by rough estimate) with an alphanumeric password raises resistance to brute-force and social-engineering PIN-reset attacks, and multiple passkeys close a gap that previously forced dual-platform users toward weaker fallback credentials.

Privacy: Android caller-context data (country of origin, shared groups) appears to be drawn from information WhatsApp already has access to, and is shown only to the call recipient.

WhatsApp rolled out multiple passkeys per account and replaced its six-digit two-step verification PIN with a full alphanumeric password, alongside new Android caller-context warnings.