- How to turn on two-step verification
- PIN or password? It's changing
- Why you should add an email address
- What trusted devices do
- If you forget your two-step verification password
- Two-step verification vs passkey vs app lock
- How the scam it stops works
- Signs you need it right now
- My verdict
- Frequently asked questions
WhatsApp two-step verification adds a password on top of the SMS code, so nobody can register your number on another phone without it. Turn it on in Settings, then Account, then Two-step verification. Add an email address too, because it's your easiest way back in if you forget the password.
Most WhatsApp account takeovers happen the same way: someone tricks you into sharing the 6-digit code WhatsApp texts you, then registers your number on their phone. Two-step verification blocks that. Even with the SMS code, they'd also need your password. It takes two minutes to set up and it's the single best thing you can do for your account's security.
How to turn on two-step verification
- Open WhatsApp and go to Settings.
- Tap Account, then Two-step verification.
- Turn on Turn on two-step verification.
- Create a strong password and confirm it.
- Add an email address you can access and tap Next, or tap Skip.
- Tap Trust this device if this is your everyday phone, or Skip.
PIN or password? It's changing
If you set this up years ago, you'll remember a 6-digit PIN. WhatsApp says it's upgrading that PIN to a password. If you already have a PIN, you'll be invited to switch. The new password rules are stricter:
| Requirement | Rule |
|---|---|
| Minimum length | At least 8 characters |
| Letters | At least 1 letter |
| Numbers | At least 1 number |
A tick appears next to each requirement as you type, so you'll know when it passes. Use something you'll remember but nobody could guess from your social media. Your phone's password manager is a sensible place to store it.
Why you should add an email address
This is the step people skip and regret. If you forget your password, WhatsApp lets you tap Verify another way and get a code by email, SMS or voice call. Without an email on file, your options shrink. To add one later, go to Settings, then Account, then Email address, and tap Add email. WhatsApp sends a six-digit code to confirm it.
What trusted devices do
Once two-step verification is on, you can mark the phones you use every day as trusted, so logging in on them is quicker. Go to Settings, Account, Two-step verification, then Trusted devices and Trust this device. Don't confuse these with linked devices. Linked devices, such as WhatsApp Web, mirror your chats on a computer. Trusted devices are about how you prove it's you.
If you forget your two-step verification password
- On the login screen, tap Verify another way.
- Choose email, SMS or voice call, and enter the code you receive.
- If none of those work, the option to reset your account unlocks after a few days.
Think hard before you reset, because it can't be undone and what you lose depends on timing:
| Last time you logged in | What a reset deletes |
|---|---|
| Less than 30 days ago | Messages received since you last logged in. Your account and profile stay. |
| More than 30 days ago | Your messages and your profile, and they can't be recovered. |
If you're logged in and just want a new password, you don't need the old one. Go to your profile, then Account, Password, Change password.
Two-step verification vs passkey vs app lock
| Feature | What it protects | When it asks |
|---|---|---|
| Two-step verification | Stops someone registering your number on another phone | When your number is registered on a device |
| Passkey | Lets you verify with your fingerprint, face or screen lock instead of an SMS code | When you register or restore your account |
| App lock | Stops someone opening WhatsApp on your unlocked phone | Each time you open the app |
They do different jobs, so I'd use all three. WhatsApp says a passkey lets you log in faster when two-step verification is on.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
How the scam it stops works
It's worth understanding the attack, because it's convincing. A message arrives from a friend's account saying they sent you a code by mistake and asking you to forward it. Their account has already been taken over. The code is your WhatsApp registration code, and the moment you share it, the scammer registers your number on their phone and messages everyone you know with the same trick. With two-step verification on, that code alone isn't enough: they'd also need your password, which they don't have. That's why I tell every business owner I work with to switch it on the same day they install WhatsApp.
Signs you need it right now
- Someone has asked you to forward a WhatsApp code, even a friend. Their account may already be hijacked.
- You've received a verification code you didn't ask for.
- You use the same phone number on lots of websites, making it easy to target.
If your account has already been restricted or behaves oddly, see my guide on why WhatsApp is restricted. And if you've wondered how traceable your account is, read whether WhatsApp can be traced.
My verdict
Turn on two-step verification today, choose a password with at least 8 characters including a letter and a number, and add an email address so you can always get back in. Never share a WhatsApp code with anyone, however convincing the message.
Frequently asked questions
How do I turn on two-step verification on WhatsApp?
Go to Settings, Account, Two-step verification, turn it on, create a password and add an email address.
Is WhatsApp two-step verification a PIN or a password?
WhatsApp is upgrading the old 6-digit PIN to a password with at least 8 characters, 1 letter and 1 number.
What if I forget my WhatsApp two-step verification password?
Tap Verify another way and get a code by email, SMS or voice call. If that fails, a reset option unlocks after a few days.
Does resetting two-step verification delete my messages?
It can. Within 30 days of your last login you lose messages received since then. After 30 days you lose messages and your profile.
