WhatsApp changes account security: What billions of users need to know

For years, one of WhatsApp’s most important account protections has depended on something remarkably simple: six numbers.

That is now changing.

WhatsApp is rolling out a major upgrade to its account security, replacing the familiar six-digit PIN used for two-step verification with the option of a longer password containing letters, numbers and special characters. The Meta-owned messaging service is also expanding passkey support and giving Android users more information before they answer calls from unknown numbers.

The changes arrive as account takeover attempts, phishing and social-engineering attacks increasingly target the person using a messaging app rather than trying to break the encryption protecting their conversations.

And with WhatsApp used by more than three billion people worldwide, even relatively small changes to the way accounts are secured can have an enormous reach.

Goodbye to the six-digit security PIN

WhatsApp’s two-step verification has traditionally worked as an extra barrier after the verification code sent when registering a phone number.

Even if someone managed to obtain that one-time code, they would still need the user’s six-digit PIN to complete the process.

The new system strengthens that second barrier.

Instead of being restricted to six numbers, users can choose a longer alphanumeric password that includes special characters, enabling significantly more combinations and making passwords harder to guess. TechCrunch reports that the change is part of WhatsApp's broader effort to make account protection more accessible as hacking and phishing techniques become more sophisticated.

It is a relatively small change from a user's perspective. Still, it closes an obvious limitation of the old system: six-digit PINs offer only a finite number of combinations, whereas a sufficiently long, unique password is considerably harder to predict or brute-force.

WhatsApp is betting bigger on passkeys

WhatsApp is also expanding its use of passkeys.

Instead of authenticating with a conventional password, passkeys allow users to verify themselves using the security already built into their devices — such as a fingerprint, Face ID or screen lock.

WhatsApp previously supported one passkey. Users can now create multiple passkeys for the same account, particularly useful for people moving between Android and iOS devices. More than one billion WhatsApp users have already created a passkey, according to the company.

The attraction is partly security. Passkeys are designed to resist conventional phishing because there is no password for a user to hand over on a fake login page accidentally.

WhatsApp has also extended passkeys beyond signing into an account. They can be used to protect end-to-end encrypted chat backups, allowing users to unlock protected backups using their device authentication rather than remembering a separate password or 64-digit encryption key.

That mystery WhatsApp caller will reveal more

The third change tackles a different problem: deciding whether to answer an unfamiliar call.

On Android, WhatsApp will display additional information about callers who are not saved in a user's contacts. That can include whether the number originates from another country and whether the caller shares any WhatsApp groups with the recipient.

It does not determine whether a call is fraudulent, but it gives users more information before they answer.

The feature arrives amid a broader push by WhatsApp to combat scams and account hijacking. WhatsApp introduced Strict Account Settings earlier this year for people at higher risk of sophisticated attacks, including journalists and public figures. It subsequently introduced warnings to identify potentially fraudulent device-linking requests and has been testing an optional Scam Alert feature that uses on-device machine learning.

The threat is not theoretical. In March, Reuters reported that Dutch intelligence agencies had warned of a Russia-linked hacking campaign targeting Signal and WhatsApp accounts belonging to officials, military personnel and journalists.

Encryption isn't the same as account security

WhatsApp's messages remain protected by end-to-end encryption, meaning the contents are readable only by the sender and recipient.

But encryption cannot necessarily protect an account when an attacker persuades its owner to hand over a verification code, approve a malicious device-linking request, or otherwise grant access.

That helps explain the direction WhatsApp is taking. Rather than relying on a single security mechanism, the service is building additional layers around the account itself: stronger two-step verification, phishing-resistant passkeys, encrypted backups, suspicious device-linking warnings, and more information about unknown callers.

The latest features are rolling out gradually on iOS and Android, so they may not appear immediately for every user. Users can check for passkey support under Settings > Account > Passkeys and should keep WhatsApp updated as the new protections become available.