The 6-digit two-step verification PIN currently used on WhatsApp may be replaced. The platform, in fact, is apparently working on the introduction of an alphanumeric password (therefore made up of letters and numbers) between 6 and 20 characters.
At first glance it might seem like a marginal change, but the use of letters in addition to numbers would significantly expand the number of combinations available. The novelty would concern the personal key chosen by the profile owner, requested after confirmation of the telephone number, while the overall functioning would depend on the rules adopted by WhatsApp. Enabling two-step verification, however, will not be mandatory.
The password could take the place of the PIN: 6 to 20 characters
The reference to the new system was spotted in beta version 2.26.29.4 of WhatsApp for Android. The elements in the application show a message inviting you to replace the PIN with a password.
Today, the PIN used for two-step verification is a personal 6-digit code chosen by the account owner. When you try to register the same phone number on another device, this sequence is requested in addition to the temporary code sent by the service.
With the solution under study it would also be possible to use alphabetic characters. The password would take the place of the PIN rather than alongside it, thus avoiding the introduction of a further control.
This setting represents a change of direction compared to a previous solution considered by the platform. Initially, a credential of between 6 and 20 characters, containing at least one letter and a number, was hypothesized to be added to the already existing combination. The most recent indications instead suggest the presence of only one element for the second level of verification.
Because an alphanumeric password offers many more combinations
The difference between the two formats can be understood through combinatorics. In theoretical terms, a 6-digit PIN can take on all sequences between 000000 and 999999, for a total of 106that is, 1,000,000 possibilities.
An alphanumeric password can instead use letters in addition to digits and, if it is longer than the current code, offer an even greater number of configurations. In the absence of definitive indications from WhatsApp it is not possible to precisely quantify this difference, but the combinations would grow rapidly as the usable characters and key length increase.
Greater variety, however, does not automatically guarantee effective protection. Expressions like “password1”, first names, birth dates and keyboard sequences remain easy to predict.
Security would therefore also depend on the choice made by the user. The key should be long, not very predictable, without personal references and different from those used on other services. The tendency to use common formulas is in fact one of the reasons why some passwords are particularly vulnerable.
The password would not replace the code received via SMS
To understand the change it is necessary to distinguish the two codes currently involved in registering an account. The temporary one sent via SMS or communicated through a call serves to verify that the person has the indicated telephone number. It is generated for a specific request and cannot be chosen by the recipient.
The two-step verification PIN, on the other hand, is configured in advance by the profile owner. When this protection is active, the message received on the phone is not enough to complete the procedure on a new device and you also need to know the secret information set in the app.
The password under development would concern exclusively this second element. The temporary code would continue to be necessary to confirm ownership of the address, while the combination chosen by the user would be the next barrier.
The distinction is also relevant to the 6-digit code scam on WhatsApp. In these scams, criminals try to convince the victim to communicate the sequence received via SMS, so as to try to transfer the profile to another smartphone.
A more complex personal key could hinder theft if the attacker had already come into possession of the first code. However, it would offer no defense if it were handed over voluntarily: PINs, passwords and confirmation sequences should never be shared via chat, calls or pages reached through suspicious links.
When it might arrive and what would happen to PINs already set
It is not yet known how the transition would be handled for those who have already activated two-step verification. The application may invite these people to create a new password, but at this time no complete screenshots of the procedure have been shown nor have any official instructions been provided.
Other aspects that need to be clarified include the length allowed, the characters accepted and the method provided for recovering access if you forget it. It also remains to be seen whether the update would be offered automatically to those who already have a PIN or whether it would be necessary to intervene manually from the settings.
The system is still in a preliminary phase and is not even available for beta testers. There is no release date and WhatsApp has not publicly announced the arrival of the change. What emerged therefore describes a solution in progress, which could undergo further changes, or not reach the stable version of the app.
