WhatsApp is substituting its six-digit security PIN with a genuine password.

      WhatsApp is transitioning from the six-digit PIN previously used for two-step verification to a complete alphanumeric password, with over a billion users having already set up a passkey. Additionally, Android users will receive more information about calls from numbers not saved in their contacts.

      Quietly, WhatsApp has established itself as the largest passwordless implementation globally. While announcing a series of account security updates, the company highlighted that more than a billion users have created a passkey.

      This number highlights the extent of the shift more than the accompanying features. No other consumer service has successfully transitioned as many individuals from codes to device-based authentication.

      A passkey replaces the code by using the phone itself. Instead of receiving a one-time password via SMS, users can confirm their identity using a fingerprint, facial recognition, or the screen lock that already secures their device.

      The initial change is minor yet overdue. WhatsApp will replace the six-digit PIN for two-step verification with a complete password that can include letters, numbers, and special characters.

      Six digits were never a substantial barrier. It allows for a million combinations, which only poses a significant challenge if attempts are limited in frequency. This is now being replaced with a method that users can strengthen effectively.

      A solution has been introduced for those with two phones. Users can now store multiple passkeys for their accounts, including distinct ones for Android and iOS, under Settings, Account, Passkeys.

      The third change addresses scams and is currently limited to Android. Calls from numbers not in your contacts will provide additional context, such as whether the number is international or if you share any groups.

      The geographical aspect adds a European dimension. WhatsApp is the default messaging app in many parts of the continent, which is also where Meta has had to comply with the Digital Markets Act.

      This compliance is the less-discussed aspect. WhatsApp now supports third-party chats in Europe, and Meta has granted access to rival services under the conditions set by Brussels.

      However, the issue of account security does not seamlessly integrate with this development. A passkey safeguards your WhatsApp account but does not protect the accounts of those messaging you from different services, and there has been no clear explanation as to how security assurances align, including within Meta’s own interoperability framework.

      In the meantime, Europe is crafting its own solution for identity verification, which involves a state-issued digital wallet that member countries are required to provide. This situation presents two methods of identity verification; one comes via a product update, while the other is a regulatory development.