WhatsApp ditches 6-digit PIN for passwords, adds passkey support: All you need to know

WhatsApp has unveiled new security features designed to make account takeovers and scam calls more difficult. The messaging platform's six-digit two-step verification PIN is being replaced with a more secure password option, while users will soon be able to create multiple passkeys across different devices.

The update also gives Android users additional information when they receive calls from unknown numbers. WhatsApp will now show details such as whether the caller is from another country and whether they share any groups with the recipient. The changes come as scammers increasingly rely on social engineering rather than technical hacking to target users on messaging platforms.

WhatsApp upgrades two-step verification

Since 2017, WhatsApp has offered six-digit PIN-based two-step verification. Users can now opt for a password containing letters, numbers and special characters instead of the PIN.

WhatsApp says the password must include at least one number and one letter and be at least eight characters long. Users can set it up by going to Settings > Account > Password.

The move could make accounts harder to compromise, as simple PINs may be easier to guess, particularly when users choose predictable combinations. However, a stronger password will only improve security if users avoid weak or commonly used passwords.

Multiple passkeys can now protect one account

WhatsApp has also added support for multiple passkeys. Users can now add one or more passkeys when using WhatsApp on Android or iOS devices.

Passkeys rely on a device's built-in security features, such as Face ID, a fingerprint or a screen lock. This eliminates the need to remember another password or rely on SMS codes for authentication.

WhatsApp has also added support for passkeys. Now, users can add one or more passkeys when using WhatsApp on their Android or iOS devices.

Passkeys rely on the built-in security feature on a device, including Face ID, a fingerprint or the screen lock. This eliminates the need to keep track of another password or SMS codes for authentication.

WhatsApp says more than 1 billion people have already set up a passkey. Users can manage their passkeys by going to Settings > Account > Passkeys.

This may be the more significant security update. Passkeys are harder for scammers to steal through phishing because there is no code that users can share with an attacker to complete the login process.

Unknown calls now come with more context

WhatsApp is also giving Android users additional information about calls from people who are not in their contacts. Before answering, users may now see the caller's country and any groups they share with the caller.

Cybersecurity expert Joseph Steinberg told CNET that this additional context could help users identify suspicious callers who falsely claim to be members of a shared WhatsApp group.

The timing of the update is significant. While WhatsApp's new security measures aim to protect accounts from being compromised, the platform is increasingly focusing on preventing scams before users interact with suspicious messages or calls.

For users, the key takeaway is to enable two-step verification and set up a passkey on compatible devices. These measures will not prevent every scam, but stronger, harder-to-steal authentication can reduce the potential damage if users fall victim to a scam message or phone call.