WhatsApp may soon add support for traditional alphanumeric passwords, expanding beyond its long-standing reliance on SMS-based one-time passwords for login authentication.
For years, WhatsApp has allowed users to sign in using a verification code sent via SMS. While convenient, this method has also exposed accounts to risks such as SIM swapping, where attackers gain control of a phone number and intercept login codes.
Passwords in addition to two-factor authentication
According to WABetaInfo, a new beta version of WhatsApp for Android, version 2.26.7.8, includes references to an optional password feature.
The report suggests that WhatsApp will allow users to set a traditional password in addition to:
- SMS one-time password verification
- The existing six-digit two-factor authentication PIN
If implemented as described, users who enable the feature would need:
- Their phone number
- The SMS verification code
- Their six-digit 2FA PIN
- The new alphanumeric password
This layered approach would significantly strengthen account security for users who opt in.
RELATED: WhatsApp Working on Scheduled Messages Feature
Designed to combat SIM swapping
SIM swapping remains one of the primary weaknesses of SMS-based authentication systems. Since WhatsApp logins traditionally require only a phone number and an OTP, attackers who gain access to SMS messages can potentially take over accounts.
WhatsApp previously introduced a six-digit PIN as an added safeguard. However, the addition of a full alphanumeric password would introduce a more conventional and robust authentication barrier.
Optional, not mandatory
The password feature does not appear to be mandatory. Instead, it is expected to function as an optional security enhancement for users who prioritize stronger account protection.
There is no confirmed release timeline. As with most beta features, WhatsApp is likely testing functionality and stability before a broader rollout.
If finalized, this would mark a notable shift in WhatsApp’s authentication model, bringing it closer to traditional account security standards used across most digital platforms.
