WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android
- ID
- 17656
- Status
- summarized
- Published
- 25 Aug 2026, 9:19 PM
- Fetched
- 25 Aug 2026, 10:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/whatsapp-adds-multiple-passkeys-for.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 25 Aug 2026, 10:44 PM
- Tags
- Audience
- developersvibe_coders
What happened
WhatsApp now supports multiple passkeys per account across iOS and Android, letting users with both device types sign in phishing-resistant without SMS codes. Over 1 billion people already use a passkey for WhatsApp login. Two-step verification also upgraded from a 6-digit PIN to a full alphanumeric password with special characters, and Android now shows extra context (origin, contact status, shared groups) for calls from non-contacts.
Why it matters
If you build anything on top of WhatsApp Business API or rely on WhatsApp for customer comms in Malaysia/SEA, your users will soon expect passkey-grade login UX and stronger 2FA as the default. The multi-passkey-per-account model is worth studying as a reference for your own multi-device auth designs—1B+ users is the largest passkey deployment signal yet.
Discussion angle
WhatsApp moving 2FA from a 6-digit PIN to a full password is a notable UX regression for convenience—does that signal passkeys aren't replacing traditional 2FA as fast as vendors claim, and what does that mean for how you design your own auth fallback flow?