WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update
WhatsApp now supports multiple passkeys per account, benefiting users who operate on both iOS and Android devices Two-step verification (2SV) has been upgraded from a six-digit PIN to a full password supporting alphanumeric and special characters Over 1 billion users now rely on passkeys to log in to WhatsApp accounts New caller context feature on Android displays caller country and shared group membership for non-contact calls to help users identify potential scams These updates complement the
Analysis
TL;DR
- WhatsApp now supports multiple passkeys per account, benefiting users who operate on both iOS and Android devices
- Two-step verification (2SV) has been upgraded from a six-digit PIN to a full password supporting alphanumeric and special characters
- Over 1 billion users now rely on passkeys to log in to WhatsApp accounts
- New caller context feature on Android displays caller country and shared group membership for non-contact calls to help users identify potential scams
- These updates complement the previously launched AI-powered Scam Alert feature for flagging suspicious messages from non-contacts
Why It Matters
WhatsApp's security enhancements reflect the growing industry shift toward passkey-based authentication as a phishing-resistant alternative to traditional passwords. The upgrades address real user pain points—multi-device passkey management and stronger 2SV—while the caller context feature demonstrates how contextual information can serve as a lightweight behavioral defense against social engineering attacks.
Technical Details
- Passkey Support Expansion: Users can now register multiple passkeys per account, enabling seamless cross-platform authentication between iOS and Android without losing access when switching devices
- 2SV Password Upgrade: The two-step verification system has transitioned from a fixed six-digit numeric PIN to a full password system that supports longer strings, alphanumeric characters, and special characters, significantly increasing the entropy of the secondary authentication layer
- Caller Context Feature (Android): When receiving calls from non-contacts, the app surfaces metadata including the caller's country and whether they share any WhatsApp groups with the recipient, providing contextual signals to assess legitimacy
- AI-Powered Scam Alert: An optional feature using AI to detect and flag suspicious messages from non-contacts, operating as a complementary layer alongside the new caller context tool
Industry Insight
- The multi-device passkey rollout signals that major platforms are recognizing the friction of single-passkey limitations and are adapting WebAuthn-based authentication for real-world multi-device usage patterns
- The 2SV password upgrade demonstrates a broader industry trend of treating secondary authentication with the same rigor as primary authentication, moving beyond legacy PIN-based systems that offer insufficient protection
- WhatsApp's layered approach—combining AI-based message scanning, caller context metadata, and stronger authentication—illustrates the emerging best practice of defense-in-depth for consumer messaging platforms facing escalating social engineering threats
Disclaimer: The above content is generated by AI and is for reference only.