WhatsApp Adds Multiple Passkeys, Replaces 2FA PIN
In short
On August 25, 2026, WhatsApp said over a billion people now sign in with passkeys, let accounts add more than one passkey, and replaced the six-digit two-step verification PIN with a longer password. None of it is applied automatically.
WhatsApp announced three account security updates on August 25, 2026. The company said more than one billion people now use passkeys to log in, unlocking the app with a fingerprint, face scan or screen lock instead of typing a code.
The first change is that one account can now hold more than one passkey. That matters for people who use WhatsApp on both Android and iPhone, since each platform stores its passkeys separately. Passkeys are managed under Settings > Account > Passkeys.
The second change affects two-step verification. The old six-digit PIN has been replaced with a full password that can be longer and mix letters, numbers and special characters. Existing PINs are not converted automatically, so accounts keep their current setup until the owner upgrades it. A recovery email added to two-step verification is the way to reset that password if you forget it.
The third change is on Android: for calls from numbers that aren't in your contacts, WhatsApp now shows whether the number is from another country and whether you share any groups with the caller.
None of this removes phone numbers from WhatsApp. An account is still tied to a number, and the registration SMS or call is still how a number gets verified on a new phone. Passkeys and the new password protect the account after that point. If you register with a number you won't keep, do it only for your own legitimate account, and add a passkey and recovery email right away, because a lost number plus a forgotten password can mean a lost account.
What to do
After you register WhatsApp, add a passkey, switch your two-step PIN to a strong password and add a recovery email so you aren't relying on SMS alone.
Sources
Related services
Related guides
Two-Factor Authentication Explained: SMS, Authenticator Apps, Passkeys and Security Keys
2FA explained: SMS codes, authenticator apps, passkeys and hardware security keys compared, with clear recommendations for your accounts.
Read the guide →App guidesHow to Change Your WhatsApp Number Without Losing Your Account
Use WhatsApp's Change number feature to move your account, chats and groups to a new number, and why you shouldn't move to a temporary number.
Read the guide →More news
Discord Starts Global Age Assurance for All Accounts
On September 22, 2026, Discord began a global rollout that places every account in an adult, teen or unconfirmed group based mainly on account signals. Discord says more than 90% of users won't be asked to confirm their age manually.
Read →August 1, 2026Microsoft Is Phasing Out SMS Codes for Personal Accounts
In August 2026, Microsoft said it will start phasing out SMS as a sign-in and recovery method for personal Microsoft accounts, pushing passkeys, verified email and Apple or Google sign-in instead. It has not published a final cutoff date for consumers.
Read →July 27, 2026UK SIM Farm Ban: Offences Apply From October 29, 2026
The UK's Crime and Policing Act 2026, which received Royal Assent on April 29, 2026, creates offences for possessing or supplying SIM farms without good reason. Home Office guidance published July 27, 2026 says penalties apply from October 29, 2026.
Read →July 15, 2026Ofcom Finalizes Rules to Block UK Scam Texts
On July 15, 2026, Ofcom finalized rules requiring UK mobile operators to block scam numbers and messages and limit how many texts pay-as-you-go SIMs can send, plus checks on business senders and sender IDs. They take effect in January and July 2027.
Read →