WhatsApp lets one account hold several passkeys, closing the cross-platform gap
Meta announced on August 25, 2026 that WhatsApp accounts can register multiple passkeys, so a user carrying both iOS and Android no longer has to bind to one ecosystem. Two-step verification also moves from a six-digit PIN to a full password.
Meta announced on August 25, 2026 that a single WhatsApp account can now register multiple passkeys, managed under Settings, Account, Passkeys. The practical effect is that someone carrying both an iOS and an Android device no longer has to bind their phishing-resistant credential to one platform's sync fabric. Meta also upgraded WhatsApp two-step verification from a six-digit PIN to a full alphanumeric password, and gave Android users more context on calls from non-contacts, including origin location and shared group membership. WhatsApp shipped passkeys on Android in October 2023 and iOS in early 2024, and Meta says over a billion people now use them to sign in.
Why it matters
Single-passkey-per-account was one of the quietest adoption blockers in consumer passwordless. If a user can only hold one credential, losing the device means falling back to SMS, and a cross-platform user has to pick a sync ecosystem and stay in it. Allowing several credentials per account is the same lesson enterprises learned with hardware keys: always enrol at least two. If you are designing a CIAM login, copy this shape. Support multiple credentials from day one, make the enrolment prompt appear on a second device rather than at first sign-up, and keep the recovery path honest about what happens when every registered device is gone. Our passkey rollout checklist covers the enrolment and recovery decisions.
Source: The Hacker News
Related on Start with Identity
- BlogRSA brings passwordless authentication to Linux servers, closing its last password-only gap
RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizati
- BlogEntra ID makes passkeys the default, and retires SMS and voice in 2027
From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- RecipeAdd passkeys with WebAuthn
Implement passkey registration and authentication with the WebAuthn ceremonies: generate and verify challenges on the server, call navigator.credentials on the
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea