WhatsApp Passkeys Go Multi-Device for 1 Billion Users

Passkeys have a quiet usability problem that has held back adoption for years: most implementations let you register exactly one, which is fine until you own both a phone and a tablet, or you switch platforms. WhatsApp addressed that on August 25, 2026 with an account security update that lets a single account carry several passkeys at once — alongside two other changes that are arguably more consequential for everyday users.

• Users can now register multiple passkeys per account across iOS and Android, managed under Settings, then Account, then Passkeys
• Meta says more than 1 billion people already use a passkey to log into WhatsApp
• Two-step verification moves from a six-digit PIN to a full password that can be longer and include alphanumeric and special characters
• Android users receiving calls from unknown numbers now see caller context, including country of origin and whether the caller shares any of their WhatsApp groups

Why Multiple Passkeys Matter More Than They Sound

A passkey is a device-bound credential — the private half never leaves the authenticator, which is exactly what makes it phishing-resistant. No secret is typed, so no secret can be typed into the wrong site. That property is the whole point.

The catch is that device binding cuts both ways. If an account supports only one passkey and it lives on your phone, then your tablet, your work device and your backup phone are all second-class citizens that fall back to a weaker method. Allowing several registered credentials removes the single point of failure without weakening any individual one, and it eliminates the most common reason people turn passkeys off after trying them: losing access when a device is replaced.

At WhatsApp's scale that is not a small change. A billion accounts already using passkeys makes this one of the largest deployments of the technology anywhere, and improving retention on the feature has more real-world security value than most new controls.

What Does the Two-Step Verification Change Actually Fix?

The move from a six-digit PIN to a full password is the least flashy item and possibly the most useful. A six-digit numeric PIN has a million possible values, which sounds like plenty until you consider that people reuse the same six digits from their phone unlock and their bank card, and that a limited-guess system still leaks meaningful information under targeted attack.

Allowing a longer alphanumeric password with special characters raises that ceiling by orders of magnitude and, more importantly, lets a password manager generate and store it. That turns a memorised number into a managed secret, which is the direction every credential should be moving.

Caller Context as a Social-Engineering Speed Bump

The Android caller-context feature is a defensive design choice rather than a cryptographic one. When an unknown number calls, showing the country of origin and whether the caller shares any groups with you gives the recipient two cheap signals to reason about before answering.

Most voice-based social engineering depends on the target having no context at all in the first few seconds. Supplying even coarse context — this call is from a country you have no connection to, and this person shares no groups with you — is the sort of low-cost friction that stops a meaningful fraction of attempts without blocking legitimate calls. It is the same philosophy behind Microsoft Teams blocking external meeting bots by policy: make the default state informative rather than silent.

For readers tracking authentication and identity hardening, the passkey side of this is the part worth acting on. Registering a second passkey on a spare device takes under a minute and removes the failure mode that makes most people abandon the feature. More defensive security coverage lives on our AI security page.

Sources: Meta Newsroom — August 25, 2026; The Hacker News — August 25, 2026; BleepingComputer — August 25, 2026; TechCrunch — August 25, 2026.