Over a billion people use passkeys on WhatsApp, multiple passkeys and stronger passwords arrive
WhatsApp said more than a billion people have set up a passkey on their account and enabled adding more than one passkey per account. Two-step verification is also moving from a six digit PIN to a long alphanumeric password. On Android, caller context for unknown numbers is getting richer.
Passkeys passed one billion users
Per the WhatsApp statement, more than a billion people on the platform have set up a passkey on their account. A passkey authenticates using the device biometric or screen lock instead of a classic password.
What is new is the number of passkeys. Per the announcement, users can add more than one passkey to their account if they use both Android and iOS devices, removing the single passkey limit introduced in 2023.
Per Social Media Today reporting dated August 25, 2026, these updates are offered on both Android and iOS.
Two-step verification and caller context
The second headline is two-step verification. The system moves from the long standing six digit PIN structure to a longer alphanumeric password.
Per WhatsApp, the new password can include special characters and the aim is making it harder to guess. The difference between a six digit PIN and a long password with character variety is direct protection against brute force attempts.
The third headline is the calling experience on Android. Calls from unknown numbers now show the user additional context.
That context carries two pieces of information: whether the number originates from a different country and whether there is a shared group membership with the caller. The aim is letting the user decide whether to answer with information in hand.
The passkey setting can be enabled in the app through the settings section under the account and passkeys menu.
The announcement notes these features are being rolled out gradually, and the sources give no precise rollout timeline.
Account security is no longer personal, it is institutional
The assessment in this section is ours. A WhatsApp account is a personal app for most users, but for a very large share of small and mid sized businesses it is sales itself.
When a business WhatsApp account is compromised, what is lost is not message history, it is the customer relationship and reputation. A fake payment request sent to customers from a compromised account can burn trust built over years in a single day.
Passkeys reduce that risk meaningfully, because there is no password an attacker can trick out of someone. The most common account takeover method in Türkiye is social engineering the verification code out of the user. Passkeys largely close that attack surface.
Support for multiple passkeys solves a practical problem. Authentication tied to a single device meant losing access when the device was lost. A second passkey leaves a recovery route in that case.
The change in caller context is also about fraud. Flagging a call arriving from a different country gives the user a decision signal on its own.
What it means for businesses in Türkiye
The assessment below does not appear in the sources, it is our reading. The announcement contains no Türkiye specific information.
Türkiye is one of the markets where WhatsApp is used most intensively for business communication. Appointments, orders, quotes and payment conversations largely run through this channel. Account security is therefore directly a business continuity matter.
The practical first step is this: is a passkey set up on your business account and is two-step verification on? Checking those two items today is the cheapest precaution available.
The second point is who holds access. The pattern we often see in the field is a business WhatsApp line living on an employee's personal phone. When that person leaves, both the account and the customer history are at risk. Multiple passkey support helps here, but the real fix is writing down who owns the line and how it gets handed over.
The third is a recovery plan. If it is not decided in advance how the account gets recovered when a device is lost or stolen, the time lost during a crisis stretches. A second passkey is meaningful for exactly that scenario.
The fourth is customer communication. Telling customers in advance that you will never ask them for a code or verification detail is the most effective antidote to fraud. That one sentence sometimes does more work than technical measures.
The UNALSOFT take
In the systems we build we treat WhatsApp not as a communication channel but as a sales line, because that is how it actually works in Türkiye. For many of our clients the conversations coming from WhatsApp buttons on the site are the highest converting channel. That is why on every project we deliver we ask the same three questions: who owns the line, is two-step verification on, and what is the recovery route if the device is lost. This passkey update makes two of those three easier. The third is still institutional rather than technical: a business sales line should not be entrusted to an employee's personal phone.
Who holds the security of your sales line?
Let us write the access and recovery plan for your business accounts.