WhatsApp adds alphanumeric two-step passwords, multiple passkeys and caller context

WhatsApp has begun rolling out a package of account-security improvements, headlined by a tougher two-step verification option, the ability to register more than one passkey, and richer details about incoming calls from unfamiliar numbers. According to TechCrunch, the Meta-owned messaging service announced the changes on Tuesday.

Two-step verification gets an upgrade

WhatsApp's two-step verification has until now relied on a six-digit PIN, a safeguard meant to stop an account takeover even when an attacker manages to intercept the one-time code sent to a user's phone. According to TechCrunch, users can now replace that short PIN with a longer password combining letters, numbers and special characters, making the credential far harder to guess. The update addresses the weakest point of the previous design: six digits offer limited room for randomness, and memorable PINs are often trivially guessable.

Passkeys, plural

WhatsApp added passkey support in 2024, letting people sign in with Face ID or a fingerprint instead of the username-and-password combinations that phishing pages are built to harvest. TechCrunch reports that accounts can now hold more than one passkey, a practical change for anyone who uses both iOS and Android devices. Because the private portion of a passkey stays on a user's hardware, a remote attacker cannot simply phish their way in — as TechCrunch notes, they would need physical access to the device itself.

Judging calls from unknown numbers

On Android, calls from numbers that are not in a user's contacts will now come with extra context, TechCrunch reports: whether the call originates from a different country, and whether the caller shares any WhatsApp groups with the recipient. That turns an opaque unknown number into something a person can quickly evaluate before deciding to answer — a modest but meaningful defense against spam and scam calls that rely on curiosity to get picked up.

A busy stretch of updates

The security additions land during a run of changes to the app. In late June, WhatsApp introduced usernames so people could share profiles without disclosing their phone numbers. In late May, Meta launched a paid Plus tier for the messenger that includes profile customization, super reactions and story insights, released alongside similar Plus offerings for Instagram and Facebook. According to TechCrunch, the wider backdrop is a push among messaging apps — Signal and Telegram included — to make strong security easier for everyday users as phishing and account-takeover attempts have grown more sophisticated.

Why it matters

Account takeover is the central threat for any messaging app, because a hijacked account exposes conversations, group memberships and the trust of everyone in the victim's contact list. Each of these changes lowers the effort required to do the secure thing: a longer password beats a six-digit PIN, multiple passkeys remove the single-device dependency that made the feature awkward for dual-platform users, and caller context gives people a basis for judgment where they previously had none. For a mass-market messenger, small reductions in the friction of staying secure compound across the entire user base, and the updates keep WhatsApp in step with rivals that treat security and privacy as their core selling points.