WhatsApp is replacing its six-digit PIN with a real password

If somebody gets hold of the six-digit code WhatsApp texts you, they can walk off with your account. That's the whole mechanism behind every "hi, can you vote for my friend" message doing the rounds, and behind every SIM swap. WhatsApp announced two changes today that make the second lock on the door considerably harder to pick.

Two-step verification has always been a six-digit PIN. It's becoming a real password instead, and WhatsApp's own description of it is "longer, alphanumeric, and even with special ch@racters to make it harder to guess." When WABetaInfo found the feature in development back in July, the rules were six to twenty characters with at least one letter and one number. You'll find it under Settings, then Account. It's the setting that stops a stolen verification code being enough on its own, and the one most people never switched on because six arbitrary digits felt pointless.

The other change is about passkeys - the thing that lets your fingerprint or face stand in for a typed code. Until now WhatsApp allowed exactly one per account, which was awkward if you carry an Android phone and also use an iPad, because a passkey lives in one platform's keychain and the other can't read it. You can now add more than one. WhatsApp reckons over a billion people have set one up already. It's under Settings > Account > Passkeys. Android is separately getting more detail on calls from numbers you don't recognise: whether the call is coming from outside your country, and whether you share any groups with whoever is ringing.

Ten minutes well spent this evening, if only because a WhatsApp account is a convincing enough impersonation of you to borrow money from your own family. If you also use WhatsApp on the PC rather than just the phone, that install is worth keeping current - Tendvane's app-update check finds out-of-date programs and updates them through winget.