WhatsApp turns its six-digit account PIN into a password

WhatsApp announced three account security changes on August 25. The one most people will notice sits in a menu they filled in once and never touched again: the six-digit PIN behind two-step verification. It is turning into a password.

Six digits are guessable, eight characters less so

Two-step verification is the layer that holds when someone else gets hold of your one-time SMS code. Until now it was a six-digit PIN. WhatsApp's own blog is unusually blunt about how that went in practice: "If you were using 123456, now is a good time to upgrade."

The replacement is a password. The screenshot in WhatsApp's announcement spells out the rules: at least eight characters, at least one letter, at least one number. Special characters are allowed but not required. That is not a high bar. Set against six digits, it is still a different order of magnitude.

The protection targets one specific attack. Anyone who takes over your phone number, through SIM swapping or through an old number that has been handed to someone else, receives the one-time code as well. Without the second hurdle, the account is gone in that moment.

More than one passkey, for anyone on both Android and iPhone

WhatsApp says more than a billion people have set up a passkey. A passkey replaces codes and PINs with a fingerprint, Face ID or the screen lock. What is new is that an account can hold more than one. Anyone running an Android phone alongside an iPhone previously had to pick a side. The setting sits under Settings, Account, Passkeys.

Passkeys are the part that changes the most. A password can be phished and so can an SMS code. The private half of a passkey never leaves the device, which is why ordinary phishing gets nowhere with it. That does not close every gap: anyone who hijacks a session you are already signed into needs neither a password nor a second factor.

Android shows where an unknown call comes from

The third change is Android only. When a number that is not in your contacts rings, WhatsApp now adds context: the country the number belongs to, and whether the two of you share any groups. The example image in the announcement shows a German mobile number labelled "not in your contacts" and "you are both in 2 groups".

It is aimed at scam calls that work through time pressure. WhatsApp puts it plainly: "Scammers rely on urgency, so take a moment with this extra info before you pick up." This is context, not detection. Checking what a message actually says is a separate test, and that one only looks at strangers as well.

What to do with it

The three features are not landing all at once. WhatsApp describes them in its own post as things it is "working on". If the password option is missing from your app today, nothing is broken.

Once it turns up, this order makes sense: set up the passkey first, then switch two-step verification over to a password. And pick one you will actually find again. WhatsApp asks for it rarely, usually when you sign in on a new device, which is exactly the moment the old one may be out of reach. What else helps when you lose access is written up separately.