WhatsApp upgrades account security with passwords and multiple passkeys

WhatsApp has announced three account security upgrades: stronger two-step verification, support for multiple passkeys, and more information about unknown callers on Android.

The first two changes protect the login process. The third gives Android users more context before answering a WhatsApp call from a number they do not recognize.

Two-step verification is getting a real password

WhatsApp’s two-step verification has relied on a six-digit PIN. The app is upgrading that PIN to a longer password that can contain letters, numbers, and special characters.

This extra check helps protect an account even when someone gets its one-time login code. It is a worthwhile change because a short PIN such as 123456 is easy to guess, but users still need to choose a unique password and keep their recovery details current.

Your Complete iOS 26 Playbook:

Get our exclusive Ultimate iOS 26 Guide 📚 — absolutely FREE when you sign up for our newsletter below.

[convertkit form=6147905]

Our WhatsApp account security guide covers the other settings worth checking, including linked devices, encrypted backups, and group permissions.

One account can now have multiple passkeys

More than one billion people have set up a WhatsApp passkey, according to the company. A passkey lets you verify your account with Face ID, a fingerprint, or your device’s screen-lock code instead of typing a code or PIN.

WhatsApp now lets an account hold more than one passkey. This is meant for people who use the same account across both iOS and Android and need a passkey tied to each device ecosystem.

You can check the option under Settings > Account > Passkeys. The feature is separate from the two-step verification password, so using one does not make the other redundant.

Android shows more details for unknown callers

When a non-contact calls through WhatsApp on Android, the incoming-call screen can now show whether the number is from another country and whether you share any groups with that person.

Those clues can help flag an obvious scam, but a shared group is not proof that a caller is trustworthy. WhatsApp’s earlier Strict Account Settings can apply more restrictive protections for people at higher risk of targeted attacks.

The caller-context feature is Android-only for now. WhatsApp has not announced an iPhone date. iPhone users can still use WhatsApp Privacy Checkup to silence unknown callers and review who can contact them.