WhatsApp Passkeys Explained: What They Are and How to Set Them Up

Anyone who has tried to reinstall WhatsApp while travelling internationally, or in an area with patchy mobile signal, knows the particular frustration of waiting for a verification code that simply does not arrive. The 6-digit SMS system has been WhatsApp’s default login method for years, functional but dependent on your carrier delivering a message at exactly the right moment.

WhatsApp now has a better answer. Passkeys bring a faster, more secure login experience to both Android and iPhone, and once set up, they work even when your SMS does not.

What Is a WhatsApp Passkey?

A passkey is a cryptographic credential stored directly on your device. Instead of asking WhatsApp’s servers to send you a code and waiting for it to arrive, a passkey uses your phone’s built-in security system, fingerprint scanner, face recognition, or screen lock PIN to verify that you are who you say you are.

The key difference from traditional authentication methods is that your biometric data never leaves your device. WhatsApp does not see your fingerprint. Your face data does not travel to a server. The verification happens locally, on your phone, using hardware that is already protecting your device every time you unlock it.

The result is login verification that is faster than waiting for an SMS, more secure than a password, and immune to the SIM-swap attacks and SMS interception methods that make code-based verification vulnerable.

Why Passkeys Are More Secure

SMS verification codes have a well-documented weakness: they depend on your phone number remaining in your control. SIM-swapping, where an attacker convinces a carrier to transfer your number to their SIM, can hand someone else your verification codes entirely. SMS codes can also be intercepted through network-level attacks that most users have no visibility into.

Passkeys eliminate this attack surface. Because the credential is tied to your physical device and your biometric data, an attacker would need both your actual phone and your fingerprint or face to gain access. That combination is significantly harder to compromise than a phone number alone.

For WhatsApp specifically, an app that holds personal conversations, financial messages, and sensitive documents for hundreds of millions of users, that security upgrade is meaningful.

Device Requirements

Before setting up a passkey, your device needs to meet a few basic requirements.

For Android users: Your phone must run Android 9 or later. You will also need a password manager account linked to your device, Google Password Manager connected to a Google account or Samsung Password Manager connected to a Samsung account both qualify. A lock screen must be configured, and Password Manager must be enabled. You can verify this under Settings > Passwords > Passkeys and accounts.

For iPhone users: You need an iPhone 8 or newer running iOS 16 or later, with a lock screen set up. That covers the vast majority of iPhones currently in active use.

How to Set Up a WhatsApp Passkey

The setup process takes under a minute on both platforms.

Step 1: Open WhatsApp and tap Settings.

Step 2: Tap Account, then Passkeys, then Create passkey, then Continue.

Step 3: Tap Continue again. You may be prompted to tap Use screen lock to confirm the passkey creation.

Step 4: WhatsApp saves the passkey automatically to your default Password Manager app, Google Password Manager on most Android devices, or iCloud Keychain on iPhone.

That is the entire process. Once created, your passkey will be available the next time WhatsApp needs to verify your identity, including when reinstalling the app or restoring your account.

One practical note: if you reinstall WhatsApp and have a passkey already set up, the app may offer to use it during registration. If you want to update or change your passkey at any point, you will need to delete the existing one and create a new one.

How to Delete a WhatsApp Passkey

Step 1: Open WhatsApp and tap Settings.

Step 2: Tap Account, then Passkeys.

Step 3: Tap Delete, then confirm by tapping Delete again.

Is It Worth Setting Up?

Passkeys are not mandatory. WhatsApp has not removed SMS verification; the two methods coexist. But the question of whether to set up a passkey has a fairly clear answer: yes, and there is no meaningful downside to doing so.

The most practical argument is the scenario WhatsApp itself highlights: situations where SMS delivery fails. International travel with a local SIM. Carrier outages. Areas with poor network coverage. In each of these cases, an SMS code may simply not arrive, and without a passkey as a fallback, you are locked out of your account until it does.

For Pakistani users specifically, where mobile network reliability varies significantly across urban and rural areas, and where carrier issues are not uncommon, a passkey provides a login method that functions independently of network conditions at the moment of verification.

The security argument adds further weight. Moving away from SMS-based authentication is a direction the broader technology industry has been pushing for several years, and WhatsApp’s passkey implementation follows the same FIDO2 standard used by Google, Apple, and Microsoft across their own platforms. It is not an experiment; it is a mature security standard arriving in WhatsApp’s ecosystem.

Setting up a passkey takes less than a minute. The protection it provides, faster login, stronger account security, and independence from SMS delivery make it one of the more straightforwardly useful account settings WhatsApp has introduced in recent memory.

Via Wabetainfo.