WhatsApp says more than one billion people have set up passkeys for their accounts, as the messaging service rolls out additional protections for signing in and handling potentially suspicious calls.
The updates include support for more than one passkey on an account, a move from a six-digit two-step verification PIN to a longer password, and extra information about callers who are not saved in a user’s contacts. WhatsApp announced the changes on 26 August 2026.
Multiple passkeys for Android and iOS devices
A WhatsApp passkey lets a user verify their identity with the fingerprint, face recognition or screen-lock code already configured on their device. According to WhatsApp, more than one billion people have now set one up.
Users can also add multiple passkeys to the same WhatsApp account. This is intended for people who access the service across both Android and iOS devices, allowing each device ecosystem to use its own passkey instead of relying on a one-time code or account PIN for verification.
The option can be found under Settings > Account > Passkeys. Availability may depend on the version of WhatsApp and the rollout reaching a user’s device.
Two-step verification moves from a PIN to a password
WhatsApp is also upgrading its two-step verification credential. The existing system uses a six-digit PIN designed to make account takeover more difficult even when an attacker obtains a one-time registration code.
The replacement supports a longer alphanumeric password, including special characters. This allows for a credential that is harder to guess than a short numeric PIN, although users should still choose a unique password and avoid reusing one from another service.
This change concerns account verification rather than message encryption. WhatsApp continues to use end-to-end encryption by default for personal messages and calls, while passkeys and two-step verification are intended to protect access to the account itself.
Android shows more context for unknown callers
On Android, calls from numbers outside a user’s contacts will show more context before the call is answered. WhatsApp says this can include whether the number is associated with a different country and whether the caller shares any groups with the recipient.
The information may help users pause before responding to an unfamiliar caller, particularly when a scammer is trying to create urgency. It should not be treated as proof that a caller is legitimate: a shared group or local-looking number does not independently verify someone’s identity.
WhatsApp has not provided a device-by-device rollout schedule for the three updates. Users who do not yet see them should keep the app updated and check the relevant account settings as availability expands.
Source: WhatsApp announcement.
