Quick Answer
WhatsApp is replacing its six-digit two-step-verification PIN with a longer password that can include letters, numbers, and special characters. Meta announced the change on August 25, 2026, alongside multiple-passkey support and added context for unfamiliar Android callers. Existing users must update their own settings, so review two-step verification, recovery email, trusted devices, and passkeys now.
Key Takeaways
- WhatsApp is moving from a six-digit PIN to a longer password for two-step verification.
- The new password can use letters, numbers, and special characters.
- WhatsApp users can now register more than one passkey for the same account.
- Android users can see country and shared-group context for unknown WhatsApp callers.
- Existing PIN and passkey users must manually enable the new protections.
What changed in the WhatsApp security update?
WhatsApp is replacing its previous six-digit two-step-verification PIN with a longer password that can use letters, numbers, and special characters. Meta announced the change on August 25, 2026, as part of 3 account-security updates that also include multiple-passkey support and more information about unfamiliar callers. Meta’s announcement describes the new password as a stronger alternative to the older numeric PIN.
The password change matters because a fixed six-digit number provides a narrower set of possible combinations than a password built from several character types. A longer password does not eliminate account-takeover risks on its own, particularly when a user shares credentials or loses access to recovery options. The practical response is to choose a password that is unique to WhatsApp and keep recovery information current.
WhatsApp has not said that every account will be moved automatically from the old PIN format to the new password system. Users who already use two-step verification need to review their own account settings and make the change when the option appears. The update is therefore useful only after the account owner completes the setup.
Why is a WhatsApp password stronger than a six-digit PIN?
A WhatsApp password can provide stronger two-step-verification protection because it can contain letters, numbers, and special characters instead of only 6 digits. The wider character choice gives users more flexibility to create a credential that is harder to guess than a simple numeric code. WhatsApp’s old PIN still added a layer of account protection, but the new format allows a more robust credential choice.
WhatsApp password security still depends on how the password is chosen and protected. A short or reused password weakens the benefit because a password copied across several services creates more exposure if another account is compromised. The most sensible approach is to use a password you do not use for email, banking, social media, or other messaging accounts.
| Account protection method | How it works | Main benefit | Important limitation |
|---|---|---|---|
| Six-digit PIN | Uses a numeric code for two-step verification. | Adds a separate check beyond basic account access. | Offers fewer credential choices than a longer password. |
| Two-step-verification password | Can use letters, numbers, and special characters. | Allows a stronger and more unique credential. | Still requires safe password handling and recovery details. |
| Passkey | Uses biometric or device screen-lock authentication. | Avoids manually entering a code during sign-in. | Requires a compatible device and setup by the account owner. |
WhatsApp account protection also does not prevent every privacy issue associated with phone use. Device identifiers and browsing activity can expose information in other contexts, which is why readers concerned about broader online tracking should understand browser fingerprinting risks separately from messaging-account security.
How do you update WhatsApp two-step verification to a password?
WhatsApp users with an existing PIN can update two-step verification to a password through the app’s two-step-verification settings. WhatsApp’s Help Center says users can also manage a recovery email and trusted devices from the related account-protection controls. WhatsApp’s two-step-verification instructions provide the current account-management guidance.
- Open WhatsApp and go to the account settings area.
- Open the two-step-verification controls.
- Replace the existing PIN with a longer password when the password option is available.
- Add or confirm a recovery email so the account has a recovery path.
- Review trusted devices and remove any device you no longer control.
WhatsApp users should treat the recovery email as part of the security setup, not as an optional afterthought. A recovery address that belongs to someone else, uses a weak password, or is no longer accessible can complicate account recovery. Use an email account that you control and secure that email account with its own strong sign-in protections.
WhatsApp account recovery can involve sensitive identity and ownership questions, so users should stop and use official WhatsApp support if account access is lost or a trusted device appears unfamiliar. Do not share a verification code, password, or recovery email code with a caller, contact, or website claiming to provide account support.
How do multiple WhatsApp passkeys work across devices?
WhatsApp now lets users add more than 1 passkey to the same account, including users who use both Android and iOS devices. Meta said more than 1 billion people have already set up a WhatsApp passkey, and the in-app route for adding one is Settings > Account > Passkeys. Multiple passkeys reduce the chance that a user loses the only available sign-in method after changing phones or using more than one device.
WhatsApp passkeys use biometric authentication or the device screen lock instead of requiring a manually entered code during sign-in. Google and Meta said WhatsApp adopted passkeys in 2023, while their August 27 technical explanation describes the newer multi-passkey deployment. Google and Meta’s technical account says the system maintains a bounded credential list.
WhatsApp’s passkey system can remove the oldest credential when the account reaches its credential limit, according to Meta engineer Ashish Choudhary. The company has not published the limit in the research provided here, so users should not assume every older device will remain registered indefinitely. Review passkeys after replacing a phone, and remove access from devices that are sold, lost, or no longer used.
What does WhatsApp show for unknown callers on Android?
WhatsApp can now show added context for incoming Android calls from numbers outside a user’s contacts. Meta said the call screen can indicate whether the caller is in another country and whether the caller shares any WhatsApp groups with the recipient. The feature gives users more information before answering, which can help them distinguish an expected group contact from an unfamiliar number.
WhatsApp caller context does not block calls, prove a caller is legitimate, or identify every scam attempt. A shared group can explain why a number is visible, but shared membership does not establish that the caller should be trusted. The practical response is to avoid discussing verification codes, passwords, payments, or recovery information with an unknown caller.
WhatsApp group membership can create legitimate reasons for unfamiliar contacts to call, especially after a group expands or a member changes phone numbers. Users who rely on larger communities may also want to review recent group-chat controls, since group settings and participant information affect how easily unfamiliar contacts appear in normal use.
Who needs to take action after the WhatsApp security update?
WhatsApp users who still rely on the old PIN or have not enabled a passkey need to take action because the new protections are not applied automatically. Malwarebytes noted on August 28, 2026, that users will not be moved to the new password or passkey protections unless they enable them themselves. Malwarebytes’ security guidance emphasizes the need to review the account configuration rather than assuming the rollout changed it.
WhatsApp users with a new phone, a second phone, or both Android and iOS devices have a particular reason to add and review passkeys. Multiple passkeys can support access across those devices, but the account owner remains responsible for checking which credentials remain active. Remove access from any device that is no longer physically under your control.
WhatsApp users who have received suspicious calls or messages should also update their contact and group awareness. Unknown-caller context can help with a decision before answering, but account security still depends on refusing unexpected requests for credentials. A security feature is most effective when users recognize what it does not verify.
What should you do to secure a WhatsApp account now?
WhatsApp users should update two-step verification to a password, add passkeys to devices they control, and confirm the recovery email and trusted-device list. Those 4 actions address the specific protections announced on August 25, 2026: a stronger credential, passkey access across devices, account-recovery readiness, and device review. Complete the review from the WhatsApp app rather than following a link sent in a message or email.
- Update the old six-digit PIN to a longer, unique password.
- Add a passkey through Settings > Account > Passkeys.
- Register another passkey if you regularly use a second supported device.
- Confirm that the recovery email belongs to you and remains accessible.
- Remove trusted devices or passkeys associated with old, lost, or sold phones.
WhatsApp account settings are only one part of phone security. Keeping messaging apps and the phone operating system updated remains important because software vulnerabilities can affect content handling and device safety, as recent iPhone image-processing security fixes illustrate. Stop and contact WhatsApp support or your mobile carrier if an account takeover, SIM-related access issue, or unfamiliar device cannot be resolved through the app’s normal controls.
FAQ
Does WhatsApp automatically replace the old PIN with a password?
WhatsApp does not automatically move users from the old PIN to the new password protections. Users need to open two-step-verification settings and update the account configuration themselves.
Can a WhatsApp two-step-verification password use special characters?
WhatsApp’s new two-step-verification password can use letters, numbers, and special characters. A unique password is safer than one reused from email, banking, or social media accounts.
Can you add more than one WhatsApp passkey?
WhatsApp supports more than 1 passkey for the same account. Multiple passkeys are intended to help users who access WhatsApp from both Android and iOS devices.
Does WhatsApp’s unknown caller context block scam calls?
WhatsApp’s unknown caller context does not block scam calls or confirm that a caller is legitimate. The Android feature shows country and shared-group information so users have more context before answering.
Where do you add a WhatsApp passkey?
WhatsApp passkeys can be added through Settings > Account > Passkeys in the app. Review registered passkeys after replacing or selling a phone.