Technology & Science
WhatsApp Rolls Out Alphanumeric Two-Step Verification and Multi-Passkey Support
On 25 Aug 2026, WhatsApp replaced its six-digit 2FA PIN with a mandatory-length alphanumeric password option and simultaneously enabled users to register multiple biometric passkeys on one account.
Focusing Facts
- The new two-step-verification password must contain at least 8 characters including both letters and numbers, ending nine years of the six-digit PIN first introduced in 2017.
- WhatsApp now lets the same account store more than one FIDO passkey, allowing seamless log-ins across both Android and iOS; Meta says over 1 billion users already use at least one passkey.
- Caller-ID context showing country code and mutual groups is live today for Android only, giving added scam-prevention data before users answer unknown calls.
Context
Big messaging platforms rarely tinker with core authentication flows—Telegram added optional passwords only in 2023—so WhatsApp’s shift echoes the late-1990s transition from four-digit ATM PINs to longer PINs after the 1995 UK card-skimming wave. It signals the industry’s march from knowledge-based credentials (passwords) to possession-plus-biometric models championed by the FIDO Alliance since 2012 and accelerated when Apple, Google and Microsoft jointly endorsed passkeys in May 2022. If widely adopted, such steps erode the phishing economy that flourished after the 2013-2016 Yahoo and LinkedIn mega-breaches, and they prepare for a future where humans rarely memorise secrets. A century from now this may be seen as another incremental pivot—like 1970s adoption of SSL for web traffic—toward cryptographic identity embedded in personal hardware rather than in people’s heads, gradually shrinking the attack surface of global digital communication.
Perspectives
Meta corporate communications
About Facebook — Presents the new two-step verification, passkey expansion and caller context as proof that WhatsApp steadfastly protects user privacy and keeps accounts 'in your hands'. As the platform’s own blog post, the language is promotional, highlighting only successes and omitting any mention of Meta’s past privacy controversies or competitive motives for locking users deeper into its ecosystem.
Consumer tech media
TechCrunch, Engadget, 9to5Google, FoneArena, Digit — Report the features as practical, long-awaited security upgrades and encourage readers to replace weak six-digit pins with stronger passwords and adopt multiple passkeys. Dependent on access to product teams and eye-catching headlines, most pieces hew closely to WhatsApp’s press release and rarely question whether the changes address deeper data-collection concerns or potential lock-in to Meta services.
Business and financial outlets
Investing.com, Business Standard — Frame the update as another step in Meta’s strategic drive to enhance user trust and, by extension, reinforce the company’s competitive position and shareholder value. Focused on market implications, their coverage sidesteps technical limitations or user privacy critiques, implicitly endorsing the narrative that more features equal stronger investor confidence.
Like what you're reading?