WhatsApp Implements Multiple Passkeys and Alphanumeric Two-Step Verification
The messaging platform is expanding phishing-resistant authentication options and upgrading two-step verification to support complex passwords.
WhatsApp has begun rolling out updates to its account security framework, allowing users to register multiple passkeys for a single account. This change specifically addresses users who operate on both Android and iOS devices, as they can now maintain separate passkeys for each operating system (according to BleepingComputer and SecurityWeek).
Meta reported that more than 1 billion people have already adopted a passkey to log into their WhatsApp accounts. The company first introduced passkey support on Android in October 2023 before expanding the feature to iOS in early 2024 (according to The Hacker News). Users can manage these credentials by navigating to Settings > Account > Passkeys. This update follows Meta’s broader rollout of passkey integration for Facebook logins, which occurred in June 2025 (according to The Hacker News).
Transition from PINs to Alphanumeric Passwords
The messaging service is also upgrading its two-step verification (2SV) requirements. Previously, the platform required a six-digit PIN; it now supports full alphanumeric passwords. These new credentials can include longer strings and special characters, which WhatsApp states are intended to make accounts harder to guess than previous codes like ‘123456’ (according to BleepingComputer).
WhatsApp noted that the 2SV layer is designed to prevent account takeovers even in instances where an attacker successfully intercepts a one-time passcode (according to The Hacker News). “Until now it was a six-digit PIN, we’ve now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess,” WhatsApp said (according to BleepingComputer).
Android Call Context and Scam Mitigation
For users on Android, the platform is introducing additional context for calls originating from non-contacts. When receiving a call from an unknown number, the app will display information regarding whether the caller is located in a different country and if they share any mutual WhatsApp groups with the recipient (according to BleepingComputer and SecurityWeek).
WhatsApp stated that these details are intended to help users pause before responding to high-pressure tactics. “Scammers rely on urgency – now you can take a beat with some more info before answering,” WhatsApp said (according to SecurityWeek).
This update is part of an ongoing sequence of security features released since the start of 2026. These include:
- Strict Account Settings: Launched in January, this feature provides high-risk individuals—such as journalists and public figures—with protections similar to Apple’s Lockdown mode to defend against sophisticated threats like spyware (according to BleepingComputer).
- Device Linking Warnings: Introduced in March, these warnings alert users when a device-linking request may be fraudulent. This is intended to block tactics where attackers trick users into sharing linking codes or scanning malicious QR codes (according to BleepingComputer).
- Scam Alert Beta: WhatsApp launched an optional beta feature that utilizes a local machine learning model to flag suspicious messages from non-contacts (according to BleepingComputer and SecurityWeek).
Analysis and Implementation Notes
The reports collectively illustrate a shift toward phishing-resistant authentication and increased transparency in social engineering attempts. By allowing multiple passkeys, WhatsApp is moving away from single-device dependency for hardware-backed security. The transition from 6-digit PINs to full passwords indicates a move toward standardizing password complexity across Meta’s ecosystem.
For security administrators and high-risk users, the most critical operational change is the availability of multiple passkeys. Users should verify that their credentials are correctly mapped to their respective devices in the account settings. Additionally, while the Android call context provides immediate visual cues, it does not replace the need for manual verification when interacting with unknown entities.
What to watch next: Monitor the transition of the “Scam Alert” feature from a limited beta to a general release. The use of local machine learning models suggests that WhatsApp aims to provide real-time filtering without compromising privacy by processing message content on external servers.