WhatsApp tightens account security with new safety features: What are they and how do they work?

WhatsApp has introduced a new set of security features aimed at helping users safeguard their accounts from takeovers and other online threats.

The measures, announced on Tuesday, include stronger two-step verification, the option to register multiple passkeys on a single account and additional details for calls coming from unknown numbers.

The latest changes are part of a broader effort by messaging platforms to make account protection easier as phishing, hacking and other online scams become more sophisticated. WhatsApp, Signal and Telegram have been adding security tools designed to improve protection without making the process more complicated, according to TechCrunch.

Also read | WhatsApp puts multiple accounts in India under review, blocks app access for 24 hours

Stronger two-step verification

WhatsApp’s two-step verification currently uses a six-digit PIN as an additional security layer. It is designed to prevent account takeovers even when someone manages to obtain a user’s one-time passcode.

Under the new option, users can instead create a longer password containing letters, numbers and special characters, making it more difficult to guess.

Key security updates

Longer security password: Users can opt for an alphanumeric password with special characters instead of the six-digit PIN.

Multiple passkeys: More than one passkey can now be added to the same WhatsApp account.

Unknown calls: WhatsApp is adding more information about calls received from unknown numbers.

Also read | WhatsApp reacts as multiple accounts, including in India, put under review

Multiple passkeys supported

WhatsApp is allowing users to add multiple passkeys to their accounts. The company says this could be particularly useful for people who use both iOS and Android devices.

WhatsApp introduced passkey support in 2024. The technology provides stronger protection than conventional passwords and allows users to access their accounts using features such as Face ID or a fingerprint.

Passkeys eliminate the need for traditional username-and-password combinations, which can be vulnerable to phishing attacks. They also make remote account access harder for attackers because a person would need physical access to the device storing the user's part of the passkey.