Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhatsApp’s newer account protections add stronger sign-in checks and a high-restriction mode for people who may face targeted cyberattacks. For most users, the practical starting points are a strong two-step verification password, a passkey, and privacy settings that limit unwanted contact. These measures protect an account; they do not guarantee a phone or account is safe from every kind of attack.
What WhatsApp’s new protections change
In an announcement dated August 25, 2026, Meta said WhatsApp is upgrading optional two-step verification from a six-digit PIN to a longer password that can include letters, numbers, and special characters. WhatsApp says the extra step is intended to help prevent account takeover even if someone obtains the one-time registration code. Existing users may be asked to update an older PIN, and availability or menu labels may vary during rollout.
The registration code and two-step verification password do different jobs: the code verifies the phone number during registration, while the password is an additional account check. Never share either with someone who asks for it. WhatsApp’s August 2026 announcement also reports that more than one billion people have set up passkeys; that is Meta’s company-reported figure.
Choose protections that match your situation
| Option | What it does | Best fit and trade-off |
|---|---|---|
| Two-step verification | Adds a separate password after the registration-code step. | A useful account-takeover defense for everyday users. Keep the password private and recovery details current. |
| Passkey | Lets you sign in using your device’s fingerprint, Face ID, or screen-lock code. | Convenient device-backed authentication. Its security depends partly on protecting the phone and its recovery access. |
| Strict Account Settings | Blocks attachments and media from unknown senders, silences calls from people you do not know, and restricts other settings. | Designed for people who may be targets of sophisticated, rare cyberattacks. Restrictions can make ordinary interactions with unknown people less convenient. |
| Privacy controls | Limit profile visibility, group additions, and unwanted calls or messages. | Useful for reducing unsolicited contact and exposure; not a substitute for stronger authentication or device security. |
Set up two-step verification and a passkey
Use a strong two-step verification password
Open WhatsApp’s account-security or two-step verification controls and follow the prompts to create or update the password. WhatsApp’s Help Center explains the available phone number, password, or email options under About registration and two-step verification. Menu names may differ by app version. Choose a password that is hard to guess, do not reuse a password from another service, and do not share it with anyone.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Add a passkey
WhatsApp’s announced path is Settings > Account > Passkeys. Follow the on-screen instructions to use the authentication method supported by your phone, such as a fingerprint, Face ID, or screen-lock code. Meta says people who use both Android and iOS can add more than one passkey. Keep your phone’s operating system updated, use a secure screen lock, and protect the account used to recover the device. A separate hardware security key is not identified as necessary in WhatsApp’s guidance.
When Strict Account Settings makes sense
Meta describes Strict Account Settings as a “lockdown-style” option for people who may be targets of sophisticated and rare cyberattacks, citing journalists and public figures as examples. The feature is not limited to those occupations: WhatsApp’s guidance says to enable it if you believe you may be targeted. Its announced path is Settings > Privacy > Advanced; the option may not appear identically in every app version.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
With the stricter controls, attachments and media from unknown senders are blocked, calls from people you do not know are silenced, and other settings may be restricted. That can reduce exposure, but it can also interfere with legitimate contact from someone who is not in your address book. See Meta’s explanation of Strict Account Settings and WhatsApp’s account security tips.
Reduce unwanted contact with everyday privacy controls
If you do not need the stricter lockdown, WhatsApp’s Privacy Checkup walks you through settings for messages, calls, and personal information. Silence Unknown Callers keeps calls from unknown numbers from ringing, while leaving them visible in the call list so you can check whether one matters. Meta introduced these controls as part of its privacy features.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
You can also review who can see your Last seen, Profile photo, About, and Status; options include limiting visibility to contacts or nobody. Adjust who can add you to groups, and use blocking or reporting for unwanted accounts. WhatsApp documents these options in its guidance on privacy and security and reporting and blocking.
If you receive a WhatsApp verification code you did not request
A surprise registration code can result from someone entering your number by mistake, or it may signal an attempted takeover. Do not share the code. WhatsApp says it sends a notification when someone tries to register your number; receiving that message alone does not establish that the other person has gained access. Its instructions for a verification code received without a request explain the warning.
Rank #4
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Recover an account that has been taken over
- Register your number again in WhatsApp. Enter the six-digit registration code sent to your phone. WhatsApp says successful re-registration automatically logs out other devices using the account.
- Follow the two-step verification recovery prompts if an unfamiliar PIN appears. If you do not know the PIN, WhatsApp says you may have to wait seven days before trying again.
- After regaining access, review linked devices and remove any you do not recognize. Alert trusted contacts if the account may have sent messages while someone else had access.
WhatsApp’s compromised-account recovery instructions warn that changing a password alone does not remove someone who has already taken over the account. Recovery is a separate process from enabling preventive settings.
What these protections do not establish
WhatsApp’s cited guidance describes account and privacy controls, not a guarantee against malware, a compromised phone, coercion, SIM takeover, or a determined targeted operation. Keep the device and its screen lock secure, protect the phone number’s recovery channels, and treat unexpected requests for codes or passwords as suspicious. Strict Account Settings is a more restrictive option for elevated risk, not proof that the underlying device is uncompromised.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
