WhatsApp is rolling out new account security improvements aimed at reducing the risk of phishing and account takeovers. A key update is support for multiple passkeys linked to a single account, so you can sign in from both iOS and Android devices using a phishing-resistant method.
Meta says the feature matters because more than 1 billion people use a passkey to access WhatsApp. With this change, users can keep their authentication setup flexible without giving up stronger protection.
Multiple passkeys for one WhatsApp account
Until now, passkey support expanded over time, first arriving on Android in October 2023 and later coming to iOS in early 2024. Meta has also brought passkeys into Facebook login experiences, starting in June 2025. The latest step is designed around real-world device use: carrying one identity across multiple platforms.
With the new support for multiple passkeys, you can manage more than one passkey under the same WhatsApp account. That means you can use the same phishing-resistant sign-in flow across different devices, including iPhone and Android phones, without relying on a single passkey setup.
Where to manage passkeys
If you want to review or update your authentication options, WhatsApp notes you can manage passkeys via:
- Settings > Account > Passkeys
From there, you can handle the passkeys tied to your account according to what you use day to day.
Why passkeys help against phishing
Passkeys are built to be phishing-resistant, which is a major shift compared with older credential entry methods. In practice, this means attackers have a harder time tricking you into submitting secrets through fake login pages or impersonation attempts.
WhatsApp positions this upgrade as part of a broader security push: fewer opportunities for fraudsters to harvest one-time codes and fewer reasons for users to manually type sensitive information when signing in.
Two-step verification now uses a full password
Alongside passkeys, WhatsApp is strengthening two-step verification. Previously, the second factor was described as a six-digit PIN. Now, WhatsApp says it has been upgraded to a full password.
In WhatsApp’s announcement, the new approach supports longer passwords that can include numbers and letters. It also supports special characters, which can make the password harder to guess.
WhatsApp’s message is clear: if you have been using something like 123456, this is your cue to choose a stronger replacement.
Two-step verification is intended to add an extra protection layer so that even if someone obtains your one-time passcode, they still can’t easily take over your account.
More context for suspicious calls on Android
WhatsApp is also making communication safer by adding more information about incoming calls on Android—especially for people who aren’t in your contacts.
According to WhatsApp, this added context can include details such as:
- Where the call is originating from
- Whether the caller is already in your contacts
- Whether both parties share any common groups
The idea is to counter a common tactic used in scams: urgency. WhatsApp suggests that if scammers push you to respond quickly, the extra background details can give you a moment to pause and evaluate before answering.
What this means for users day to day
If you use WhatsApp on both iOS and Android, the new multiple passkeys capability can reduce friction while maintaining a stronger login method. Instead of juggling a single passkey setup, you can align passkeys with the devices you actually rely on.
Meanwhile, the two-step verification upgrade replaces a simple numeric code with a credential that can be more complex and therefore more resilient. For Android users, added call context helps you assess unfamiliar callers with more than just a name or number.
Together, these changes focus on practical defenses: reduce the chance of successful phishing attempts, make second-factor protection stronger, and provide more signals when something looks off.
How to get started with the update
While rollout details can vary by device and region, WhatsApp suggests that you can begin managing your passkeys in the settings area mentioned earlier. For two-step verification, review your existing setup and update it to the new full password option when available.
If you’re on Android, pay attention to the added call details for callers outside your contacts—those signals are meant to support safer decisions in the moment.
Conclusion
WhatsApp’s latest security improvements bring meaningful upgrades in three directions: multiple passkeys for phishing-resistant sign-ins across iOS and Android, stronger two-step verification through a full password instead of a six-digit PIN, and richer call context on Android to help you slow down and verify before you respond.
If you want the most benefit, review your passkeys in Settings > Account > Passkeys and strengthen your two-step verification choice so your account is protected in multiple layers.
Source: https://thehackernews.com/2026/08/whatsapp-adds-multiple-passkeys-for.html
