WhatsApp Tightens Account Security With Stronger Two-Step Verification and Multiple Passkeys

WhatsApp is adding two changes that matter at the account layer: support for multiple passkeys and a stronger form of two-step verification. That may sound like a minor settings update, but in practice it points to a larger shift in how consumer apps are defending identity. The focus is no longer just on login convenience. It is on reducing the chances that an attacker can reuse, guess, or steal a shared secret tied to an account.

Fast Facts

• WhatsApp has started rolling out new account security features.
• The rollout includes support for multiple passkeys.
• The rollout also includes stronger two-step verification.
• The changes are about account access and recovery, not message encryption.
• The practical security value will depend on how users set up and protect their devices.

Why this matters

Passkeys are a modern authentication method built around cryptographic credentials rather than reusable passwords. In general terms, they are meant to make sign-in less dependent on secrets that can be phished, reused, or exposed in a breach. For a service like WhatsApp, that matters because account takeover can put private chats, contact access, and recovery options at risk even when the underlying message encryption remains intact.

Multiple passkeys are also important from an operational standpoint. Users often move between phones, tablets, and platform ecosystems. Allowing more than one passkey can reduce friction when a device is replaced or lost, although the exact recovery flow depends on the app and the operating system. That is a helpful convenience feature, but it also shifts some responsibility toward device security and account hygiene.

The stronger two-step verification update points in the same direction. A longer or more complex recovery secret is generally harder to guess than a short numeric code. That does not make takeover impossible, but it does raise the cost of low-effort attacks that rely on weak PINs, repeated guesses, or social engineering around recovery.

From a defensive perspective, the most interesting detail is not the feature list itself. It is the architecture behind it. WhatsApp is trying to harden the identity layer without changing the promise of end-to-end encrypted messaging. In other words, the secure channel is not the only problem. Getting the right person back into the account is part of the attack surface too.

At the time of writing, the public details do not fully establish rollout scope, platform availability, or the precise form of the stronger two-step verification secret. The available information supports a risk analysis, not a deeper claim about the deployment design.

Conclusion

The lesson here is simple: account protection is becoming more cryptographic and less guessable. That is good news for users, but only if the new controls are actually enabled and the devices behind them are kept secure. For criminal operators, the easier path keeps shrinking. For everyone else, the real takeaway is that identity protection now starts well before a message is ever sent.

TECHCROOK

hardware security key: A physical second-factor device can help secure important accounts that support stronger sign-in or recovery controls. It adds an extra possession-based check and keeps authentication separate from SMS or reusable passwords.

Scheda Techcrook: hardware security key

WIKICROOK

• Passkey: A cryptographic credential used for sign-in without relying on a shared password.
• Two-step verification: An added account check that requires a second secret or approval beyond the main login step.
• Cryptographic authentication: A login method that uses public-key methods to prove identity without revealing the private key.
• Credential manager: A system feature that stores and helps use sign-in credentials across apps and devices.
• End-to-end encryption: A protection model where only the communicating endpoints can read the message content.