WhatsApp is substituting its six-digit security PIN with an actual password.

      WhatsApp is transitioning from the six-digit PIN used for two-step verification to a full alphanumeric password, with over a billion users already having created a passkey. Additionally, Android users will receive more context regarding calls from unknown numbers.

      The app has quietly established itself as the largest passwordless system globally. In announcing a series of account security updates, WhatsApp revealed that more than a billion of its users have set up a passkey, which is a significant achievement not matched by any other consumer service in moving users away from codes to device-based authentication.

      With a passkey, the phone serves as a replacement for the code. Instead of receiving a one-time password via SMS, users authenticate using a fingerprint, facial recognition, or their device's screen lock.

      The more immediate update is a relatively minor yet overdue change. WhatsApp will be replacing the six-digit PIN used for two-step verification with a complete password that can include letters, numbers, and special characters. The previous six-digit option was not particularly secure, allowing for a million combinations, which provided only a meaningful barrier when attempts were limited; it is now being replaced with a more robust user-created password.

      A solution for users with two phones has also been introduced. Accounts can now store multiple passkeys, including different ones for Android and iOS, accessible under Settings, Account, Passkeys.

      The third update focuses on scams but is currently available only to Android users. Calls from numbers that are not in your contacts will now display additional context, such as whether the number is international or if you share any common groups.

      This change is particularly relevant in Europe, where WhatsApp is the default messaging app in many regions, and where Meta has been compelled to adapt the app in accordance with the Digital Markets Act.

      This new feature is part of a broader adjustment. WhatsApp is now facilitating third-party chats in Europe, and Meta has allowed access to rival services based on the terms set by Brussels.

      However, the intersection of account security and these new functionalities remains unclear. A passkey secures your WhatsApp account but does not extend protection to those messaging you from other services, and there has yet to be clarification on how these safeguards align, especially in Meta's interoperability framework.

      Meanwhile, Europe is developing its identity verification system through a state-issued digital wallet mandated for member states to offer. This results in two distinct methods of identity verification: one arising from a product update and the other from regulatory requirements.