WhatsApp replaces 6-digit PINs with a password-based second factor

WhatsApp is rolling out a password-based version of two-step verification, adding support for multiple passkeys on the same account, and giving Android users more context before they answer unknown calls. Together, the changes replace the old six-digit PIN with a longer password, make passkey access more flexible across devices, and show extra clues such as country and shared groups before a call is picked up on Android. For businesses and operators that depend on a WhatsApp account staying reachable, the practical effect is stronger protection against account takeovers and faster screening of suspicious inbound calls.

From six-digit PINs to a password-based second factor

The biggest change is in WhatsApp's two-step verification system. Instead of relying on the six-digit PIN that the app previously used, WhatsApp is moving to a longer password that can include letters, numbers, and special characters. That raises the ceiling on account protection for a setting that has long been limited to a short numeric code.

This password is not something users will need to enter every time they open WhatsApp. It works as a recovery and login-protection layer, which means it is aimed at moments when an account is being registered, recovered, or otherwise accessed in a sensitive flow. In practice, that gives users another barrier against takeover attempts tied to stolen registration codes, social engineering, or other efforts to seize control of an important account.

Rollout details are still incomplete. WhatsApp has not confirmed a broad timing window or how existing six-digit PIN setups will transition to the new password system, so availability may vary for now.

Multiple passkeys on one WhatsApp account

WhatsApp is also expanding passkey support by allowing more than one passkey on the same account. Passkeys are not new to WhatsApp, but this change makes them more usable for people who move between devices instead of treating one phone setup as the only secure login path.

The clearest use case is for people who work across Android and iPhone. A single account can now be tied to multiple passkeys, which should make access management cleaner for users who switch platforms or keep more than one primary device in use. Meta says more than 1 billion people have already configured a WhatsApp passkey, so this is an upgrade to an existing security tool that already has meaningful adoption.

For someone who switches between Android and iPhone, or keeps WhatsApp available on more than one device, multiple passkeys reduce the odds of getting locked into a single handset's login setup. That can make account continuity easier during phone changes, repairs, or cross-platform moves without falling back to weaker recovery workarounds.

Android gets clues before you answer an unknown call

On Android, WhatsApp is adding more pre-answer context for calls from numbers that are not saved in a user's contacts. Before answering, users can now see whether the number appears to be from another country and whether the caller shares any WhatsApp groups with them. Those are small interface cues, but they give a user a faster read on whether a call looks familiar, expected, or worth ignoring.

That is especially useful for people who receive a high volume of unknown calls through WhatsApp. A country indicator can help flag unexpected international contact, while a shared-group note can quickly separate a cold inbound call from someone who at least has an existing connection point. It does not remove scam risk, but it gives users more to work with before they pick up.

For now, that caller-context feature is described only for Android. Coverage of the update does not confirm the same pre-answer details for iPhone, so Apple users should not assume the feature is available on both platforms yet.

Disclaimer: This article was created with the assistance of AI. Images are for illustrative purposes only.