WhatsApp says more than one billion people now use a passkey

WhatsApp said more than a billion people are protected with a passkey, and Android and iOS accounts can now store more than one. The company is also replacing the six-digit two-step verification PIN with a longer alphanumeric password that can include special characters.

Editorial illustration of a phone lock and passkey

On August 25, 2026 WhatsApp said more than one billion people now use a passkey on the app, and it published more account-security changes.

What we know

WhatsApp said more than one billion people are now protected with a passkey.
Android and iOS accounts can hold more than one passkey; the controls live under Settings > Account > Passkeys.
Two-step verification is changing from a six-digit PIN to a longer alphanumeric password that can include special characters.
On Android, calls from unsaved numbers can show extra context, including that the number is foreign and whether the caller shares groups with the recipient.

Takeaways

Passkeys on WhatsApp have crossed one billion people.
A single account can now keep more than one passkey on both mobile platforms.
The old six-digit 2SV PIN is being replaced by a longer password.

Source: WhatsApp

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 25, 20263 min read

WhatsApp says more than one billion people now use a passkey

On August 25, 2026 WhatsApp said more than one billion people now use a passkey on the app, and it published more account-security changes.

What we know

WhatsApp said more than one billion people are now protected with a passkey.
Android and iOS accounts can hold more than one passkey; the controls live under Settings > Account > Passkeys.
Two-step verification is changing from a six-digit PIN to a longer alphanumeric password that can include special characters.
On Android, calls from unsaved numbers can show extra context, including that the number is foreign and whether the caller shares groups with the recipient.

Takeaways

Passkeys on WhatsApp have crossed one billion people.
A single account can now keep more than one passkey on both mobile platforms.
The old six-digit 2SV PIN is being replaced by a longer password.

Source: WhatsApp