WhatsApp is working on a security update that would replace its existing six-digit two-step verification PIN with a dedicated password. The change is intended to make it harder for attackers to take control of an account after obtaining its phone-number verification code.
The feature was found under development in WhatsApp beta for Android version 2.26.29.4. It is not currently available to beta testers, and WhatsApp has not announced when it will reach regular users.
If released, the password is expected to replace the optional PIN that WhatsApp requests when a phone number is registered on a new device.
How WhatsApp Two-Step Verification Works
WhatsApp accounts are primarily registered using a phone number and a verification code delivered by
SMS or phone call. Users can enable two-step verification to add another security check.
The existing feature asks users to create a six-digit numeric PIN. WhatsApp may request this PIN when the account is registered again, preventing someone with access to the SMS code from immediately taking control.
Users can also add an email address for PIN recovery. WhatsApp occasionally asks for the PIN inside the app to help users remember it.
Why WhatsApp Is Replacing the PIN
A six-digit PIN offers one million possible combinations, but it can still be guessed, reused or exposed through social engineering. Users may also choose predictable combinations such as birthdays or repeated numbers.
The proposed password system would support more than six characters and allow users to combine letters and numbers. A longer, unique password can provide greater resistance to guessing and automated attacks.
Its effectiveness will still depend on user behaviour. Reusing a password from another service would expose the WhatsApp account if those credentials were leaked elsewhere.
Password, Passkey and SMS Code Are Different
The proposed account password should not be confused with WhatsApp’s existing passkey support. A passkey uses a device’s screen lock, fingerprint or facial recognition to verify the user without requiring a conventional password.
It is also different from the password or 64-digit key used to protect end-to-end encrypted chat backups.
Based on the current development, WhatsApp’s SMS verification process is expected to remain in place. The dedicated password would strengthen the optional second verification layer rather than replace the phone number entirely.
What Users Should Do Now
Users do not need to change any settings because the password option has not been released. Two-step verification can currently be enabled by opening WhatsApp > Settings > Account > Two-Step Verification.
Users should select a PIN that is difficult to guess, add a secure recovery email and never share registration codes with callers or messages claiming to represent WhatsApp.
Because the feature remains under development, its interface, requirements and eventual rollout schedule may change before release.
/images/ppid_a911dc6a-image-178497203025195333.webp)
/images/ppid_a911dc6a-image-178495803258432237.webp)
