Meta-owned WhatsApp is rolling out a major set of account security upgrades designed to make it harder for scammers to take over accounts while giving users more flexible ways to verify their identity.
The latest changes strengthen two-step verification, expand passkey support, and provide Android users with additional information when they receive calls from people not saved in their contacts.
WhatsApp announced the updates on August 25, 2026, as part of its ongoing efforts to improve account protection.
WhatsApp replaces six-digit PIN with stronger password option
One of the biggest changes is an upgrade to WhatsApp's two-step verification system. Previously, users relied on a six-digit PIN as an additional layer of protection when registering their accounts.
WhatsApp is now upgrading this protection to support a full-length password. Unlike the old numerical PIN, the new password can use letters, numbers and special characters, making it considerably harder to guess.
Two-step verification adds an extra barrier against account takeovers, especially if someone obtains a user's one-time registration code.
The new password option is being introduced gradually so that availability may vary by account and rollout stage.
Multiple passkeys can now be added
WhatsApp is also expanding its support for passkeys, giving users more flexibility when signing back into their accounts.
A passkey lets users authenticate through security mechanisms already built into their devices, including a fingerprint, Face ID, or the device's screen lock code. This removes the need to remember additional passwords or manually enter verification codes.
The latest update allows users to add more than one passkey to a WhatsApp account. This could be particularly useful for people who use multiple devices or switch between Android and iOS.
WhatsApp says that more than one billion people have already set up passkeys, highlighting the growing adoption of passwordless authentication. Users can manage the feature through Settings > Account > Passkeys.
WhatsApp adds more information for unknown callers
The security update also extends to WhatsApp calls.
On Android, when someone receives a call from a number that is not saved in their contacts, WhatsApp will provide additional context about the caller. This can include whether the number originates from another country and whether the caller shares any WhatsApp groups with the recipient.
The additional information is intended to help users make a more informed decision before answering an unfamiliar call. This is particularly relevant as scammers increasingly use impersonation, social engineering and urgent phone calls to pressure victims into revealing information or transferring money.
Designed to tackle account takeover and scams
WhatsApp's latest security measures arrive as messaging platforms continue to face threats ranging from phishing and impersonation to account hijacking.
The stronger two-step verification password adds another layer of protection even if an attacker manages to obtain a one-time passcode.
Meanwhile, passkeys provide a more secure authentication method tied to the user's device, while additional caller information can help users identify potentially suspicious contacts.
The company has also introduced other security tools this year, including Strict Account Settings, a lockdown-style option designed for people who may face highly sophisticated cyberattacks.
How to use WhatsApp's new security features
Users should keep WhatsApp updated to the latest available version and check their account settings as the features become available.
For passkeys, WhatsApp says users can go to:
Settings > Account > Passkeys
Some features may vary in availability as WhatsApp continues its gradual rollout.
With stronger passwords, multiple passkeys, and more context for calls from unknown numbers, WhatsApp is adding several layers of protection to make account takeovers and social-engineering scams harder while keeping account verification relatively simple for users.
