WhatsApp Replaces Six-Digit PIN With Stronger Account Password Option
WhatsApp is introducing two new security-focused features designed to make account takeovers more difficult and give users more information before answering calls from unfamiliar numbers.
The Meta-owned messaging platform is strengthening its existing two-step verification system by moving beyond a basic six-digit PIN. At the same time, WhatsApp is adding caller-context information to incoming calls from people who are not saved in a user’s contacts list.
The changes reflect WhatsApp’s broader effort to expand its feature set without compromising the security and privacy expectations that have helped make it one of the world’s most widely used messaging services.
Two-step verification is becoming password-based
WhatsApp’s existing two-step verification feature already adds an important layer of protection to accounts. It works alongside the one-time verification code required when registering or transferring a WhatsApp account to another phone.
Until now, users could secure that process with a six-digit PIN of their choice. This meant that someone who obtained access to an unlocked phone and intercepted the one-time code would still need the account owner’s PIN before completing the transfer.
That system offered useful protection against common account-hijacking attempts, particularly situations in which another person temporarily gains access to a user’s phone or receives their verification code through social engineering.
WhatsApp is now expanding that protection by allowing users to replace the six-digit PIN with a more traditional password. The new passwords can be longer and may include letters, numbers and special characters, making them more difficult to guess or brute-force than a short numeric code.
The change should provide users with more flexibility when securing their accounts. A strong password built from a longer combination of upper- and lowercase letters, numbers and symbols is generally more resistant to unauthorised access than a six-digit PIN.
For users, the practical advice remains straightforward: choose a unique password that is not reused on other services, avoid predictable details such as birthdays or names, and store it securely through a reputable password manager if necessary.
More context for unknown WhatsApp calls
WhatsApp is also adding a new caller-information feature aimed at helping users make better decisions when receiving calls from unknown numbers.
Caller ID apps have long offered extra information about people who are not listed in a user’s contacts. WhatsApp is now bringing a similar concept directly into its own calling interface.
When a call arrives from an unfamiliar number, WhatsApp will show additional context on the incoming-call screen. This includes an indication of whether the caller’s number is registered in another country and whether the caller shares any WhatsApp groups with the recipient.
That information could be useful in distinguishing a potentially legitimate call from a suspicious or unexpected one. For example, a call from an unknown international number may deserve more caution, while the presence of a shared group could help users identify a person connected to a work chat, local community, school group or other existing conversation.
At launch, the caller-context feature is available only on Android. WhatsApp has not indicated when, or if, the same functionality will arrive on iPhone.
Gradual rollout is underway
As with many WhatsApp updates, the new account-security tools are not appearing for every user at the same time.
The password option for two-step verification and the incoming-call context feature are rolling out gradually. Users may therefore need to wait for a server-side update even if they have installed the latest version of WhatsApp from the Google Play Store or Apple App Store.
The features were not yet visible in WhatsApp version 2.26.32.83 for Android, while the option to replace a two-step verification PIN with a password was also not available on iOS at the time of writing.
Users who want to enable the new protections should keep WhatsApp updated and periodically check the app’s account-security settings. Once available, the stronger password-based verification system should offer a more robust defence against one of the most damaging WhatsApp security risks: an attacker successfully moving an account to another device.
Why the updates matter
WhatsApp account hijacking can have serious consequences. Once an attacker gains control of an account, they may impersonate the victim, access active conversations, target contacts with scams or use the account to spread malicious links and fraudulent messages.
A stronger password requirement does not remove every security risk, particularly if users share verification codes or fall victim to phishing attempts. However, it creates an additional obstacle for attackers and reduces the likelihood that a brief moment of access to an unlocked phone will be enough to compromise an account.
The new caller details are also a useful addition. They will not identify every scam call, but they give users more information before they decide whether to answer, ignore or block an unfamiliar number.
