WhatsApp announced three account security changes on Tuesday, August 25: support for more than one passkey per account, a two-step verification password that replaces the old six-digit PIN, and extra detail on incoming calls from numbers you have not saved.
The passkey change is the smallest of the three. An account was previously limited to a single passkey, and you can now register several. That helps if you move between an Android phone and an iPhone, or run WhatsApp on a tablet alongside your main handset. The option lives under Settings, then Account, then Passkeys. WhatsApp says more than a billion people have set one up, though that figure is the company’s own.
Two-step verification is the change worth doing something about. It is the second lock on your account: the code WhatsApp asks for when someone tries to register your number on a new device, which is what stops a stolen or intercepted one-time SMS code from being enough on its own. Until this week that second lock was six digits and nothing more. It is now a full password that can run longer and include letters and special characters. WhatsApp was direct about who this is aimed at, pointing at anyone still relying on 123456.
The third change is Android only for now, with no stated timeline for iOS. When a number that is not in your contacts calls you, the call screen shows extra context: whether the number is from a different country, and whether you and the caller belong to any groups in common. Neither signal proves anything by itself. A legitimate call can come from abroad, and a scammer can share a group with you.
Meta has not published a rollout schedule for any of the three, so the settings may take time to appear on your device.
What to change today
If you have never set up two-step verification, this is a reasonable moment to do it, and if yours is currently a four or six digit number you would recognize from a bank card or a birthday, replace it. The password field accepts more now, so use it. Store the result somewhere you will still have it in a year.
Passkeys are the other half of the same job, and if you have not enabled one, that is a bigger upgrade than adding a second one. Logging in with a fingerprint or face unlock means there is no code sitting in an SMS inbox for anyone to intercept.
The caller context feature needs nothing from you. It appears on its own once the update reaches your device. What the extra line buys you is a second of hesitation before you answer, which is the thing voice scams are built to deny you, so it is worth knowing it is there rather than swiping past it.
If you want the same protection on your other accounts, our Security and Privacy library covers password managers and authentication tools.
