What changed in WhatsApp security this week? Your six-digit PIN is now a full password
Meta has upgraded two-step verification from a numeric PIN to an alphanumeric password, added caller context on Android for numbers you have not saved, and started letting you register more than one passkey per account.
WhatsApp has made three changes to how accounts are protected. None of them is a shiny new button, which is rather the point. They all sit at the door a stolen account normally walks through.
The one that matters most is two-step verification. Until now that extra layer was a six-digit PIN. It is now a proper password: longer, alphanumeric, special characters allowed. Six digits give you a million combinations, which is not much of a wall in 2026. An eight-character password with letters and symbols is a different proposition entirely.
If your PIN is 123456, or a birthday, or your car registration, treat this as a nudge rather than an option. It lives under Settings, Account, Two-step verification.
Unknown callers now come with context
The second change is Android-only for the moment. When someone who is not in your contacts calls, WhatsApp will now show you a little more before you decide: whether the number is registered in another country, and whether you share any groups with that person.
That sounds minor. It is not. Voice scams run on urgency, and a foreign number with no groups in common is precisely the profile of a caller inventing an emergency. Portugal has already seen the next stage of that playbook, when fraudsters used AI to fake the kidnapping of a missing woman in Coimbra and demand a ransom from her family.
Passkeys, plural
The third change is for people who live across two ecosystems. Passkeys replace codes and PINs with a fingerprint, face unlock or your phone’s screen lock, and more than a billion people on WhatsApp now use one. Until this week you could only register a single passkey. Now you can hold several, which fixes the awkwardness of an Android phone paired with an iPad or a Mac. They are under Settings, Account, Passkeys.
Two minutes, two jobs
If you only have a moment, do two things: replace the PIN with a real password, and check that at least one passkey exists on the account. That is the difference between a login someone can hijack with an intercepted SMS and one they cannot.
The full announcement, feature by feature, is on WhatsApp’s own blog. It is the app’s second significant change in a few months, after usernames arrived and made it possible to chat without handing over a phone number.
By Oliver Grant
Image: Meta Newsroom (press material)
