WhatsApp passed 1 billion passkey users, the company said on August 25, 2026, as it rolled out a set of account security upgrades. The Meta-owned messenger now lets users swap its six-digit two-step verification PIN for a full alphanumeric password.
Key Takeaways
- WhatsApp accounts can now hold more than one passkey, which helps people who sign in from both an Android phone and an iPhone.
- Two-step verification now accepts long alphanumeric passwords with special characters in place of the old six-digit PIN.
- Android users will see extra details about calls from unknown numbers, including the caller’s country and any groups they share.
- Passkey logins use a fingerprint, face scan, or screen lock code, and WhatsApp has offered them since 2024.
What We Know?
WhatsApp framed passkeys as the centerpiece of the update in its announcement, calling them “the fastest and most secure way to verify it’s really you, with no codes or PINs.” A passkey ties the login to the device in your hand, so a stolen one-time code does an attacker little good on its own, since they would also need physical access to the phone that stores the user’s part of the credential.
Passkey support first reached WhatsApp in 2024, and users manage theirs under Settings > Account > Passkeys. The ability to register several on one account is the new part.
Rival messengers are on the same path, with Signal recently rolling out automatic key verification and Telegram adding passkey support, as phishing attempts against messaging accounts grow more sophisticated.
WhatsApp’s two-step verification previously relied on a six-digit PIN, but now users can choose a longer, alphanumeric password with special characters.https://t.co/Rr6LYGrgtB
— TechCrunch (@TechCrunch) August 25, 2026
Two-Step Verification Graduates From PIN to Password
Two-step verification is WhatsApp’s second gate, built to help stop an account takeover even when an attacker gets hold of a one-time passcode. Until now, that gate was a six-digit PIN. It can now be a real password, longer, alphanumeric, and with special characters allowed.
WhatsApp’s blog post pokes at the weakest habit directly: “If you’ve been using ‘123456,’ this is your sign to upgrade.” Anyone who has browsed recent password statistics will recognize why that nudge was needed.
Android Gets Caller Context Before You Pick Up
Calls from numbers outside your contacts will now carry more information on Android, including whether the number is from a different country and whether you share any groups with the caller. WhatsApp tied the change to scam pressure tactics: “Scammers rely on urgency – now you can take a beat with some more info before answering.“
What We Don’t Know?
A few gaps remain in the announcement, and they are worth naming. WhatsApp has not said whether the caller-context screen will come to iOS, and it has not said whether existing six-digit PINs will keep working indefinitely or eventually face a forced upgrade. The billion-passkey figure also arrived without detail, since the blog post describes the same number as people who “use” a passkey and as people who “have already set one up,” which are two different measures of adoption.
SQ Magazine’s Takeaway
The direction is plain. WhatsApp is steering people away from secrets that can be phished, like codes and short PINs, toward credentials that live on the phone itself. Anyone already on the app has three checks worth doing today. Register a passkey on each device you use, upgrade a guessable two-step PIN to a proper password, and treat unfamiliar international callers with the extra caution the new screen encourages. These steps help reduce the risk of a takeover, but no setting stops every scam.
What’s next comes down to two fronts. The first is whether the caller-context screen reaches iOS, since it launches as an Android feature. The second is how hard WhatsApp pushes PIN holders toward passwords, because a stronger option only protects the people who switch to it. Meta has kept WhatsApp on a rapid release pace this year, shipping usernames in late June and the WhatsApp Plus subscription in late May, and account security now sits inside that same push.
