The Meta-owned messaging service has announced that users can now move beyond the traditional six-digit PIN used for two-step verification and use a full password, including longer combinations of letters, numbers and special characters.
Thank you for reading this post, don't forget to subscribe!The move comes as online scams, phishing attempts and account-takeover attacks continue to become more sophisticated, making the security of messaging accounts increasingly important for individuals, businesses and public-facing professionals.
From a six-digit PIN to a stronger password
Two-step verification has long provided WhatsApp users with an additional layer of protection. It is designed to help prevent someone from taking over an account even if they manage to obtain the one-time registration code sent to the user’s phone.
Previously, users relied on a six-digit PIN. WhatsApp has now upgraded this protection to support a full password that can be longer, contain letters and numbers, and include special characters.
For users who have relied on simple combinations that are easy to remember, the update is an important reminder that account security should not be treated as an afterthought.
A strong, unique password can make it considerably more difficult for someone to guess or compromise the additional authentication layer.
Passkeys are also becoming more popular
The password upgrade is not the only security development announced by WhatsApp.
The company says more than one billion people are now using passkeys to access their WhatsApp accounts. Passkeys allow users to authenticate using security features already built into their devices, such as a fingerprint, Face ID or a screen-lock code.
WhatsApp has also expanded passkey functionality so users can add more than one passkey to their account. This is particularly useful for people who use multiple devices or move between Android and iOS.
Unlike conventional passwords, passkeys are designed to make phishing-based attacks more difficult because authentication is tied to the user’s device security system.
WhatsApp is also adding more information about unknown callers
The latest security update goes beyond account passwords.
On Android, WhatsApp is introducing additional context when users receive calls from people who are not saved in their contacts. Users can see information such as whether the caller’s number is associated with another country and whether they share any WhatsApp groups.
The idea is to give users more information before they decide whether to answer an unfamiliar call.
This is particularly relevant as scammers increasingly use unsolicited calls and messages to establish contact before attempting to obtain personal information, money or access to accounts.
Security is becoming a bigger part of the WhatsApp experience
WhatsApp’s latest changes form part of a wider push to give users more control over their accounts.
The platform already offers several security features, including two-step verification, passkeys, app lock, chat lock, encrypted backups and additional privacy controls. WhatsApp also introduced Strict Account Settings earlier in 2026, a lockdown-style security option designed particularly for people who may face rare and highly sophisticated cyberattacks, including journalists and public figures.
For everyday users, the message is straightforward: having a WhatsApp account protected only by the standard registration process is no longer the strongest option available.
What users should do
WhatsApp users should review their security settings and make use of the additional protection available to them.
Users should consider enabling two-step verification with a strong, unique password, setting up a passkey where supported, keeping WhatsApp updated and being cautious when receiving unexpected messages or calls.
It is also important to remember that WhatsApp will never require users to share their verification codes or passwords with another person.
As WhatsApp becomes increasingly central to personal communication, business conversations, customer service and professional networking across Africa, protecting the account itself is becoming just as important as protecting the conversations taking place inside it.
WhatsApp’s latest password upgrade gives users a stronger alternative to the traditional six-digit verification PIN, while passkeys and additional caller information provide further tools to reduce the risk of account takeovers and social-engineering attacks.
