WhatsApp two-step verification password: how to switch from six-digit PIN

Meta, the company that owns WhatsApp, is replacing the six-digit PIN used in two-step verification with a longer password. The change was unveiled on August 25, 2026, and the new credential accepts letters, numbers and special characters. The goal is to make life harder for criminals who try to take over accounts after obtaining the SMS code sent to a victim.

Warning signs that point to an intruder in your account

Messages sent or marked as read without the owner doing so are the main warning. Changes to the profile photo or name made without permission also point to an intrusion. In both cases, the user should check the phone right away.

Unrecognized WhatsApp Web sessions need immediate attention. Criminals often use QR codes to mirror the account on another computer. To check, open the settings, go to linked devices and disconnect any unfamiliar session.

Repeated disconnections with no clear reason may also mean access from another device. When two devices log in at the same time, the system tends to kick out the original user, so frequent cases deserve attention.

A six-digit verification code received by SMS without being requested is the clearest sign. It usually means someone tried to register the number on another phone. That code must never be passed on to anyone, including people who claim to be from WhatsApp support.

What users can do to block cloning and spying

Two-step verification remains the main barrier against registering the account on another device. With it turned on, the system asks for a PIN whenever someone tries to register the number. To activate it, the path is Settings, then Account, and finally Two-step verification.

Users can now replace the six-digit PIN with an alphanumeric password that includes special characters. That combination is harder to guess, which lowers the risk of brute-force attempts. Menu paths can change between app versions, so it is worth checking the current settings screen.

Reviewing active sessions often is still the recommended practice. Any unknown device should be disconnected immediately through the linked devices section. The check takes only seconds and cuts off long-running access.

Never share the six-digit code, even if the person says they work for WhatsApp support or another company. Scammers use social engineering, meaning convincing pretexts, to obtain that code. Any urgent request for a code should be treated as fraud.

Phones can also receive spy apps without the owner noticing. Keeping the operating system up to date and using a trusted security app helps identify and remove malicious software. A sudden jump in data use or a battery that drains fast can signal suspicious activity.

If you suspect cloning, the first step is to disconnect every suspicious device. Then change the two-step verification password. Those two actions reduce the chance that the intruder keeps access.

How to get back into a hijacked account step by step

The first move is to end every session you do not recognize, which cuts the intruder off from the conversation history. Only then should you start recovering the number.

Uninstall and reinstall the app on your own phone. When you enter the number and the new SMS code, WhatsApp requires a fresh registration and removes the criminal’s device. The procedure works on both Android and iPhone.

Whoever cloned the account may have access to the chat backup and restore it on another device. For that reason, change the iCloud password on iPhone or the Google Drive password on Android. Reinstalling alone does not close that gap.

Warn family members and contacts through another channel, such as a phone call or SMS. That way, they will not fall for requests for money or Pix, Brazil’s instant transfer system, sent in your name. Explain that the account was cloned and that transfer requests are fake.

In more serious cases, when access cannot be restored through the app itself, contact WhatsApp support to report the problem. If the criminal enabled two-step verification, recovery may take seven days, according to digital security companies.

Multiple passkeys and Android caller details arrive in the app

The update also allows more than one passkey on the same account, which helps people who use the number on both Android and iOS. A passkey logs in with a fingerprint, face recognition or the phone’s unlock code. Meta says more than 1 billion people already use passkeys to log in to WhatsApp.

On Android, calls from numbers not saved in contacts now show more information before the person answers. Users can see whether the phone belongs to another country and whether they share any groups with the caller. For now, this novelty is available only on Android.