WhatsApp replaces its 6-digit 2SV PIN with a full password

WhatsApp is rolling out a security update that replaces its six-digit two-step verification PIN with a full password, adds support for multiple passkeys on the same account, and gives Android users more context for calls from unknown numbers. Passkeys are managed in Settings > Account > Passkeys, and the caller-context tool is limited to Android for numbers that are not saved in your contacts. WhatsApp has not confirmed how widely these changes are live yet, but the package is clearly aimed at making account takeovers harder and reducing reliance on one-time codes.

WhatsApp’s six-digit 2SV PIN gives way to a full password

The biggest change is to two-step verification itself. Instead of protecting an account with a six-digit PIN, WhatsApp is shifting to a fuller password format that can be longer and include letters, numbers, and special symbols. For users who rely on WhatsApp for customer conversations, that is a meaningful change because a six-digit code is much easier to guess or reuse than a proper password.

This does not remove two-step verification from WhatsApp. It raises the barrier if someone gets a one-time passcode and then tries to take over the account. Meta is positioning the move as part of a broader effort to keep accounts under user control and cut dependence on one-time codes and easy-to-guess credentials.

Multi-passkey support now covers the same WhatsApp account

WhatsApp is also expanding passkey support in a practical way. The company says more than 1 billion people have already set up passkeys, which let them sign in with biometric or device-lock authentication instead of typing codes or PINs. Now, users can add more than one passkey to the same WhatsApp account.

That is especially useful for people who move between Android and iOS devices, or who manage work across more than one phone or platform. Instead of tying account access to a single passkey setup, WhatsApp now lets the same account carry multiple passkeys, which should make cross-device use less fragile. If you want to check whether this option is available on your account, the path is Settings > Account > Passkeys.

Android now shows more about unknown callers

On Android, WhatsApp is adding more context when an unsaved number calls. The extra information appears for calls from numbers that are not in your contacts, and it includes two specific signals: whether the caller is from another country and whether you share any WhatsApp groups with that person.

For businesses and operators who field a high volume of inbound calls, that gives frontline users a faster way to judge whether to pick up, ignore, or treat a call more cautiously. Shared-group information can help identify whether the caller has any existing link to your team, while the country indicator gives immediate context before the conversation starts. WhatsApp has not said whether iPhone users will get an equivalent tool.

Rollout scope and account migration still need clarification

WhatsApp has not confirmed rollout timing or geographic scope, and it is still unclear how existing six-digit 2SV PINs will move to the new password system, including whether users will need to reset their protection manually.

The company also has not spelled out whether the password-based two-step verification change applies automatically to current accounts or only when users update their settings. Until that is clear, the immediate effect will vary: some accounts may only see the new passkey options or Android caller context first, while the stronger 2SV setup may arrive later.

Disclaimer: This article was created with the assistance of AI. Images are for illustrative purposes only.