"More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices. To get started, go to Settings > Account > Passkeys," WhatsApp said.
Multiple passkeys: per-platform authentication
WhatsApp has expanded its passkey support to allow users to create separate passkeys for each platform they use. The service already supported passkeys for authentication through biometric or device-lock methods — fingerprint, Face ID, or a screen lock code — but the recent change lets users add multiple, platform-specific passkeys. WhatsApp’s instructions direct users to Settings > Account > Passkeys to set them up.
The company also noted uptake: more than a billion people have already set a passkey on their accounts, a detail it used to underline the scale of the feature’s deployment.
Two-step verification upgraded to full passwords
WhatsApp has replaced the previous six-digit PIN requirement for two-step verification with a full alphanumeric password option. "Until now it was a six-digit PIN, we've now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess," WhatsApp said, explicitly urging users who relied on weak PINs such as "123456" to upgrade.
The change broadens the character set and length available for the second factor on accounts, moving from a fixed numeric code to passwords that can include letters, numbers and special characters.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMore context on Android call screens to deter scam attempts
On Android devices, WhatsApp will show additional information about callers who are not in a user’s address book. The app will indicate whether a number is from a different country and whether the caller shares any groups with the user. "On Android, you'll now see more information about a non-contact caller, like whether the number is from a different country and if you have any groups in common," WhatsApp said, adding: "Scammers rely on urgency – now you can take a beat with some more info before answering."
WhatsApp framed this update as an extra layer of protection aimed at giving users context that can slow down or disrupt common social-engineering techniques used by scammers.
Earlier 2026 defenses: Lockdown-style settings, device-linking warnings, and Scam Alert
The recent passkey and password changes are part of a broader effort WhatsApp has pursued since the start of the year to reduce account takeover and fraud. In January, WhatsApp began rolling out "Strict Account Settings," described as an Apple Lockdown-style feature aimed at protecting high-risk individuals like journalists and public figures from sophisticated threats, including spyware attacks. Two months later, in March, Meta announced that WhatsApp will warn users when a device-linking request may be fraudulent — a tactic attackers use to hijack accounts by tricking users into sharing linking codes or scanning malicious QR codes.
Earlier this month, WhatsApp also introduced an optional "Scam Alert" feature in a limited beta. The company says the feature uses a local machine learning model to warn users when they're being targeted by scammers.
What this means for technologists, end users, and adversaries
- Technologists and security teams: The per-platform passkeys and alphanumeric two-step passwords change the attack surface for credential theft — teams will want to track adoption rates and ensure device management policies accommodate multiple passkeys per account.
- End users and the general public: Users who relied on simple numeric PINs are being pushed to stronger, longer passphrases; Android users will receive more context on unknown callers that could reduce impulse responses to scams.
- Adversaries and scammers: WhatsApp’s additions — context on call screens, device-linking fraud warnings, and a local Scam Alert model — are explicit efforts to blunt common social-engineering and hijacking techniques that rely on urgency and deceptive device-linking prompts.
WhatsApp framed the updates as incremental, practical changes across authentication and user interface signals intended to make account compromise and scam attempts harder to execute at scale. The company also reminded readers of its global footprint: more than 3 billion people in over 180 countries use the messaging service to communicate with family and friends.
For readers seeking the original announcement and full wording from WhatsApp, the source item is here: https://www.bleepingcomputer.com/news/security/whatsapp-adds-stronger-two-step-verification-multiple-passkeys/
