WhatsApp strengthens account security with password, passkeys

WhatsApp has introduced new account security features designed to give users greater control over their accounts, including stronger two-step verification, additional protection for passkeys and more information about calls from unknown contacts.

The company said the updates build on its end-to-end encryption, which protects personal messages and calls between users.

One of the major changes is an upgrade to WhatsApp’s two-step verification system. Previously based on a six-digit PIN, the security feature will now support a full password, including longer alphanumeric combinations and special characters.

WhatsApp said the stronger password option is intended to make it more difficult for attackers to gain control of accounts, particularly where a user’s one-time passcode has been compromised.

The platform is also expanding the information available to Android users when they receive calls from people who are not saved in their contacts.

Users will be able to see additional context, including whether the caller’s number is from another country and whether they share any WhatsApp groups.

The feature is designed to help users make more informed decisions before answering calls from unfamiliar numbers, particularly as scammers often rely on urgency and unfamiliar contacts to pressure victims into responding quickly.

WhatsApp also said more than one billion people now use passkeys to access their accounts.

Passkeys allow users to verify their identity using a fingerprint, Face ID or a device screen-lock code instead of relying on traditional codes or PINs.

The company has now introduced support for multiple passkeys on a single WhatsApp account, a feature aimed particularly at people who use both Android and iOS devices.

Users can add additional passkeys by going to Settings > Account > Passkeys.

WhatsApp said the new features form part of its continuing effort to strengthen account security and prevent unauthorised access.

The company said its security approach is built around keeping conversations between users private through end-to-end encryption while adding additional layers of protection around account access.

The latest measures are particularly relevant as account-takeover attempts, phishing and social-engineering scams continue to make control of messaging accounts a major security concern.

By combining stronger passwords, passkey authentication and additional caller information, WhatsApp is seeking to reduce some of the common routes used to compromise accounts while giving users more context before interacting with unknown contacts.