WhatsApp Adds Multi-Passkey Support & Full Password 2FA Across iOS and Android
Meta announced a suite of WhatsApp account security enhancements on Tuesday, headlined by support for multiple passkeys on a single account, enabling users on both iOS and Android to sign in using phishing-resistant credentials. The tech giant confirmed that more than 1 billion people now use a passkey to log into WhatsApp, reflecting the rapid adoption of FIDO-aligned authentication on the world's most widely used messaging platform. Passkey support was first introduced on Android in October 2023 before expanding to iOS in early 2024, and Meta later integrated passkeys into Facebook logins in June 2025. Users can review and manage their credentials by navigating to Settings > Account > Passkeys.
Alongside the multi-passkey rollout, WhatsApp upgraded its two-step verification mechanism from a six-digit PIN to a full alphanumeric password that supports special characters, significantly raising the bar against brute-force and guessing attacks. "Two-step verification is an extra protection layer that helps prevent someone from taking over your account, even if they get hold of your one-time passcode," WhatsApp explained in a blog post shared with The Hacker News. The company also encouraged users still relying on weak PINs like '123456' to take advantage of the stronger format. Anyone evaluating their existing credentials can run them through a password strength checker before configuring the new WhatsApp verification layer.
On Android specifically, WhatsApp is surfacing richer context for incoming calls from numbers outside a user's contact list, including the geographic origin of the call, whether the caller is already saved as a contact, and any shared group memberships. "Scammers rely on urgency — now you can take a beat with some more info before answering," the company said, framing the feature as a direct countermeasure against social engineering and impersonation scams that have proliferated on the platform. The added metadata gives recipients a chance to verify a caller's legitimacy before picking up, reducing the surface area for voice-based phishing.
The combined rollout underscores Meta's broader push toward passwordless and multi-factor authentication across its product family, aligning WhatsApp with industry momentum behind FIDO2 and WebAuthn standards. For users concerned about the exposure of credentials linked to their phone number, verifying that an associated email has not appeared in known dumps via a data breach checker remains a prudent first step. A broader privacy checkup can also help confirm that device-level authentication, screen lock, and biometric protections are properly enforced to complement WhatsApp's new server-side safeguards.