WhatsApp Just Made Your Account Harder to Hack — Here's What Changed

WhatsApp announced on August 25, 2026 a set of new security features designed to make accounts harder to break into, including a stronger two-step verification system, the ability to use more than one passkey per account, and extra information shown when you get a call from an unknown number (TechCrunch).

The biggest change involves WhatsApp's two-step verification, which has been mostly the same since it launched on February 10, 2017. Two-step verification means that after you enter your phone number, you also have to provide a second piece of information to prove you are really you. Originally, that second piece was a six-digit code — a number between 000000 and 999999 — that you created when setting up the feature (TechCrunch; Engadget). You set it up by going to Settings > Account > Two-Step Verification. WhatsApp's FAQ describes the feature as an optional layer that adds security by requiring two different forms of authentication, and notes that users can choose their phone number, password, or email address for the additional factor (WhatsApp FAQ).

Under the new update, users can now replace that six-digit code with a longer password that includes letters, numbers, and special characters, making it much harder for someone to guess (TechCrunch). Think of it this way: a six-digit code has one million possible combinations. A long password mixing letters, numbers, and symbols has trillions. This brings WhatsApp closer to what security professionals have always recommended for password strength.

WhatsApp has also expanded its passkey support. A passkey is a newer way to log in that replaces passwords entirely. Instead of typing something you know, you use something you have — like your face or your fingerprint — to unlock your account. The phone and WhatsApp exchange a secret digital handshake behind the scenes, and no password ever travels over the internet. WhatsApp first introduced passkeys in 2024. Because the key lives on your physical device, an attacker would need to steal your phone to break in, which makes remote hacking far more difficult (WhatsApp FAQ).

The August 2026 update now lets users register more than one passkey on a single account. WhatsApp says this is especially useful for people who use both an iPhone and an Android device, since each device can now hold its own passkey (TechCrunch).

For call screening, Android users now see extra details when a call comes in from a number they have not saved. The app shows whether the caller's number is from a different country and whether the caller shares any WhatsApp groups with them (TechCrunch). This gives people a quick way to judge whether an unknown call is spam, a scam attempt, or just someone they have not added to their contacts.

These features are part of a larger rollout through 2026. In late June, WhatsApp launched usernames, letting people share profiles without revealing their phone number. In late May, Meta introduced a paid subscription plan for WhatsApp that adds features like profile customization, super reactions, and story insights, along with similar paid options for Instagram and Facebook. In January, WhatsApp began rolling out a "Strict account settings" mode, found in Settings > Privacy > Advanced, designed to protect users from cyber attacks (TechCrunch).

WhatsApp's FAQ also notes that one-time passcodes received on WhatsApp appear only on a user's primary device — the phone used to register the account (WhatsApp FAQ). This means that even if someone has access to a linked device like a tablet or computer, they cannot see those codes.

The broader context worth flagging is that these small improvements add up. WhatsApp is layering security features that used to exist only in corporate systems onto an everyday messaging app used by roughly three billion people. Multi-passkey support fixes a real headache. Anyone who has tried using passkeys across both an iPhone and an Android tablet knows that the old one-passkey-per-account rule created awkward workarounds. Letting each device hold its own passkey solves that without making the system less secure.

Allowing longer passwords for two-step verification is a smaller change, but it matters. Six-digit codes have always been guessable, especially when people pick obvious ones like 123456. Supporting longer, complex passwords closes that gap while keeping the feature optional, as it has always been.

Taken together, each new layer narrows the ways attackers can trick people or take over accounts. No single feature here is revolutionary. But the combined effect is a messaging app whose security has moved much closer to what a professional security team would build from scratch, rather than something bolted on after the fact.