Six digits. That was what stood between a stranger holding your one-time code and your whole WhatsApp.
Fact
The facts: on 25 August 2026 Meta announced three changes to account security in WhatsApp. Two-step verification, until now a six-digit PIN, becomes a full password: longer, alphanumeric, with special characters. On Android, a call from a number outside your contacts now shows more context, for example whether the number is from another country and whether you have groups in common. Passkeys, which allow login by fingerprint, face or screen lock code, have passed one billion users, and more than one passkey can now be added if a person uses both Android and iOS. The setting sits under Settings, Account, Passkeys.
There is no vulnerability number here and none is expected. Nobody got in anywhere. This is a change to the default, made before it was needed.
Which of the three actually works
The second step. It is the protection that holds once an attacker already has your one-time code, and that is the usual move in a messenger account takeover.
Six digits are a million possibilities and they fall to patience. A password with letters, digits and symbols changes the order of magnitude. The change is small and arrives without fanfare, but it lands exactly where things break.
Two keys for two devices are not a convenience. They are the way out when the phone is gone.
Second by weight is allowing several passkeys. Until now the key was single and tied to one device, which made it a breaking point. A lost phone sent people back to codes over messages, which is the weakest link in the whole chain.
Worth noting
The call context is Android only for now. Meta does not say when it reaches iPhone and does not pretend otherwise, which is fair.
If you do one thing today, make it the second one: open the settings and swap the six digits for a password. It takes a minute and it is the only one of the three that depends on you.
Official primary sources
Meta Newsroom: New Account Security Features for WhatsApp (official announcement)The visual is generated code-art, no third-party images.