WhatsApp is replacing the six-digit PIN used for two-step verification with a full alphanumeric password, and says more than a billion users have already created a passkey. Android users will also see extra context about calls from people not in their contacts.
WhatsApp has quietly become the largest passwordless deployment on the planet. Announcing a set of account security changes, the company said more than a billion of its users have already created a passkey.
That figure is doing more work than the features around it. No other consumer service has moved a comparable number of people off codes and onto device-based authentication.
A passkey replaces the code with the phone. Instead of a one-time password arriving by SMS, you confirm with a fingerprint, a face or the screen lock already protecting the device.
The immediate change is smaller and overdue. WhatsApp is replacing the six-digit PIN used for two-step verification with a full password, allowing letters, numbers and special characters.
Six digits was never much of a barrier. It permits a million combinations, which is a meaningful obstacle only when attempts are rate-limited, and it is now being retired in favour of something a user can actually make strong.
There is a fix for people with two phones. Accounts can now hold multiple passkeys, including separate ones for Android and iOS, under Settings, Account, Passkeys.
The third change targets scams and only reaches Android for now. Calls from numbers outside your contacts will show extra context, such as whether the number is foreign or whether you share any groups.
Geography makes this more European than it looks. WhatsApp is the default messenger across much of the continent, which is also where Meta has been forced to open the app under the Digital Markets Act.
That opening is the unexamined part. WhatsApp now carries third-party chats in Europe, and Meta has offered rival services access on Brussels’ terms.
Account security does not obviously travel across that bridge. A passkey protects your WhatsApp account, not the account of whoever is messaging you from another service, and nobody has explained how the guarantees line up, including in Meta’s own interoperability proposal.
Europe is meanwhile building its own answer to identity, in a state-issued digital wallet member states must make available. Two systems for proving who you are, one arriving through a product update and one through a regulation.
If you liked the article, do not forget to share it with your friends. Follow us on Google News too, click on the star and choose us from your favorites.
If you want to read more like this article, you can visit our Technology category.