WhatsApp Rolls Out Alphanumeric Passwords and Multi-Device Passkeys

Key points

• WhatsApp is letting its 3 billion users register more than one passkey per account, so an Android phone and an iPhone can each have their own.
• The old six-digit PIN used for two-step verification can now be replaced with a full alphanumeric password including special characters.
• Android users will see extra context on incoming calls from unknown numbers, including the country of origin and any shared groups.
• The changes follow a run of anti-scam features Meta has shipped in 2024, including Strict Account Settings in January and device-linking warnings in March.
• WhatsApp says more than a billion people have already set up a passkey since the feature launched.

WhatsApp is quietly turning its login screen into something that looks a lot less like 2015.

The Meta-owned app, first reported by BleepingComputer, is rolling out three account security changes at once: multiple passkeys per account, proper passwords for two-step verification, and more information about who is actually ringing you.

In practice, these are the kind of fixes you ship when your support queue is full of people who lost their account to a scammer.

What actually changed?

Three things. You can now attach more than one passkey to your WhatsApp account, replace the six-digit backup PIN with a real password, and see extra detail about unknown callers before you tap answer.

A passkey is a login method that uses your phone's fingerprint, face scan, or screen lock instead of a password. WhatsApp added them last year, but only one per account, which was awkward if you used both an Android phone and an iPhone. Now each device can have its own passkey. The setting lives under Settings > Account > Passkeys.

Two-step verification is the backup code WhatsApp asks for when someone tries to register your number on a new phone. Until now that was a six-digit PIN, easy to guess if you picked something obvious. Meta is upgrading it to a full password, longer, with letters, numbers and special characters allowed. As WhatsApp put it in its own announcement, "if you've been using '123456,' this is your sign to upgrade."

The third change is on the call screen itself. On Android, when a number that isn't in your contacts calls you, WhatsApp will now show whether it is from another country and whether you share any groups with the caller. The idea is to give you a moment to think before you pick up.

Why is WhatsApp doing this now?

Because account takeovers and phone scams keep working. Scammers rely on speed and unfamiliarity, and WhatsApp's own product team has spent 2024 shipping features aimed squarely at both.

In January the company launched Strict Account Settings, a locked-down mode aimed at journalists, activists and public figures who get targeted with spyware. In March it started warning users when someone tries to link their account to a new device, a very common hijack trick where the attacker tricks you into scanning a QR code or reading out a linking code. Earlier this month a beta "Scam Alert" feature began flagging suspected scam messages using a machine learning model that runs on the phone itself.

The failure mode here is boringly consistent: someone gets tricked into handing over a code, or picks a PIN a bot can guess in seconds, and the account is gone. Longer passwords and multiple passkeys close both of those doors.

What should ordinary users do?

Open WhatsApp. Go to Settings, then Account. Turn on two-step verification if you haven't, and if you already have it, swap the PIN for a proper password you don't use anywhere else. If you use more than one phone, add a passkey on each.

And if a stranger rings you on WhatsApp with an urgent story about money, a delivery, or a family member in trouble: hang up. Ring the person back on their normal number.

One operational takeaway: the six-digit PIN was always the weak link in WhatsApp's recovery flow. Killing it off is overdue.