WhatsApp Bolsters Security: Replacing 6-Digit PINs with Stronger Passwords and Passkeys

WhatsApp has introduced new security layers for personal accounts, replacing the simple numeric verification code with a complex password, supported by biometric passkey technology that enhances protection against sophisticated hacking attempts.

Strengthening Protection with Strong Passwords

The company announced a radical update to the two-step verification system, where a six-digit PIN is no longer sufficient to ensure account safety, and adopting a password of at least eight characters is now essential. The new system requires combining letters with numbers, with the option to add special characters to increase password complexity, significantly expanding mathematical possibilities and making guessing practically impossible.

This move specifically targets account takeover attempts that rely on obtaining the SIM card or one-time verification code, as the complex password provides an additional barrier preventing intruders from accessing the account even if they gain access to the victim's device or cellular network.

Passkeys and Caller Information

The app expanded support for passkeys, allowing users to log in via fingerprint, face recognition, or screen lock, instead of relying on traditional passwords that can be stolen through phishing. Additionally, Android users will see extra information when receiving a call from an unsaved number, such as the country of origin and shared groups, to help them verify the caller's identity and avoid falling victim to fraud.

Technical Context

These updates come amid increasing social engineering and cyber fraud attacks targeting users worldwide, where major platforms rely on multi-factor authentication technologies to increase the difficulty of account breaches. These features are being rolled out gradually to users, requiring patience until the new options appear in settings without the need for an immediate manual update.

Users are advised to enable passkeys first and then set a strong, easy-to-remember password to protect their account from any new device, noting that the feature's non-appearance immediately does not indicate a technical issue with the app.