Summary
- WhatsApp is replacing its six-digit two-step verification PIN with a longer password that supports letters, numbers, and special characters.
- Users can now add multiple passkeys to one account, while Android users will receive more context about calls from unknown numbers.
- The stronger password cannot prevent Linked Devices scams, so regularly check connected devices and never follow unsolicited pairing instructions.
Meta has introduced several new security features to tighten WhatsApp’s account protections, including stronger two-step verification and support for multiple passkeys. Although these upgrades will make certain account-takeover attempts harder, a stronger password still can't protect you if you unknowingly authorize a scanner's device.
WhatsApp has faced its share of security scares over the years, including a zero-click vulnerability that allowed attackers to install spyware on your device a few years back. More recently, criminals have increasingly relied on phishing scams and other methods that trick users into handing over access themselves. Fake QR codes and call-forwarding scams are among the most common tactics bad actors use to access your data through WhatsApp.
But now, the new password protection option should reduce these issues — and not before too long!
WhatsApp now has stronger two-step verification passwords
And you should change yours now
Until now, WhatsApp asked you to create a six-digit PIN as an extra layer against someone trying to register your account on another phone. The updated version lets you create a full password containing letters, numbers, and special characters. We recommend using a long, unique password that combines all three. If you use a predictable PIN such as a birthday or "123456" for WhatsApp, take advantage of this update as soon as possible.
Moreover, Meta now allows you to add multiple passkeys to the same WhatsApp account. Passkeys let you log back in with your fingerprint, Face ID, or screen-lock code instead of a verification code or PIN. This can be very useful if you have the same WhatsApp account on Android and iOS devices simultaneously, since each platform can have its own passkey.
You can check for the option under Settings > Account > Passkeys.
Lastly, Android users will now see more context for calls from numbers outside their contacts. WhatsApp may indicate whether the number is from a different country and whether you and the caller share any WhatsApp groups. That should provide a better idea of who may be calling before you answer.
A stronger WhatsApp password still cannot prevent every takeover attempt
While it's true that these upgrades close several gaps, they cannot protect someone who unknowingly grants an attacker access. A scammer can trick you into linking their browser to your account without ever needing the new password. It's always good practice to visit Settings > Linked Devices to review every computer, browser, or phone connected to your account, and remove anything unfamiliar.
It's also worth checking WhatsApp’s less obvious privacy settings, including options to limit message floods from unknown accounts and protect your IP address during calls. Last but certainly not least, never scan a WhatsApp QR code or enter a linking code because a website, message, or supposed support representative instructed you to.