WhatsApp's two-step verification works differently from standard TOTP-based 2FA. Instead of a time-based code from an authenticator app, WhatsApp uses a 6-digit PIN that you create yourself. This PIN is required whenever you register your phone number on a new device, providing a critical line of defence against SIM-swap attacks — where an attacker transfers your phone number to a SIM they control and then re-registers your WhatsApp account.
How to Enable Two-Step Verification on WhatsApp
- Open WhatsApp on your phone.
- Tap the three-dot menu (Android) or Settings tab (iPhone).
- Go to Account → Two-step verification.
- Tap Enable.
- Create a 6-digit PIN. Choose something you can remember but that is not obvious. Do not use your phone lock code or a PIN you use elsewhere.
- Confirm the PIN by entering it again.
- Optionally, enter your email address as a backup recovery method. This is highly recommended — if you forget your PIN, WhatsApp can email you a reset link.
- Confirm the email address if you entered one.
- Tap Done.
How WhatsApp Two-Step Verification Works
After enabling two-step verification, WhatsApp will periodically ask you to enter your PIN while using the app — this is to help you remember it. More importantly, when you re-register your WhatsApp account on any device (for example, after getting a new phone or if your number gets SIM-swapped), WhatsApp requires the PIN before allowing access. An attacker who takes control of your phone number will be blocked from accessing your WhatsApp messages without the PIN.
WhatsApp vs Standard TOTP 2FA
It is important to understand what WhatsApp's two-step verification does and does not do. Unlike services that use TOTP or SMS codes at every login, WhatsApp's PIN is specifically tied to device registration. Your day-to-day use of WhatsApp on your current phone is not interrupted by 2FA prompts. The protection kicks in when someone tries to register your number on a new device — which is exactly the scenario a SIM swap creates.
Changing Your WhatsApp PIN
To change your PIN, go to Settings → Account → Two-step verification → Change PIN. You will need to enter your current PIN first. Change your PIN if you think it may have been compromised or if you set it to something too easy to guess.
Forgot Your WhatsApp PIN?
If you forget your PIN and have a recovery email set up, tap Forgot PIN? on the verification screen and WhatsApp will send a reset link to your registered email. Without a recovery email, you have two options: wait 7 days from the last time you registered the number (WhatsApp will then allow you to proceed without the PIN), or wait 30 days, after which WhatsApp will disable two-step verification entirely on the account. During this waiting period, you cannot use WhatsApp on a new device.
WhatsApp Two-Step Verification on WhatsApp Web
WhatsApp Web (web.whatsapp.com) links to your phone's WhatsApp session rather than re-registering your number independently. This means your two-step verification PIN is not required when linking a new WhatsApp Web session — only when re-registering your phone number. WhatsApp Web sessions can be managed and logged out from Settings → Linked devices.
Common WhatsApp 2FA Problems and How to Fix Them
PIN prompt while using the app: WhatsApp occasionally asks for your PIN "so you remember it" — this is normal and not a sign of a problem. If you genuinely do not remember the PIN, use the Forgot PIN? flow with your recovery email rather than guessing repeatedly; wrong entries do not reset anything and can extend the waiting period if you trigger the reset flow without an email.
Recovery email not arriving: Emails from WhatsApp can land in spam, so check there first. Verify you typed the address correctly during setup — the address can only be changed by someone who knows the current PIN, which is exactly why you should keep it current when you change mail providers. If the reset link does not arrive after checking spam and waiting for the resend interval, contact WhatsApp support with proof of ownership of the number.
New phone prompts for a PIN you never set: If a phone you just registered asks for a PIN you do not recognise, the account may already have been protected by whoever last used the number — treat this as a sign the number was previously registered and investigate before assuming the account is yours.
Additional WhatsApp Security Settings Worth Enabling
Two-step verification protects your account, but it does not protect the device itself. Set a lock on your phone so a stolen handset cannot be used to open WhatsApp directly, and review Settings → Privacy to control who can see your last seen, profile photo, and status — each option can be set to My contacts instead of Everyone. The Linked devices list shows every device attached to your account; log out anything you do not recognise immediately.
If you change phone numbers, use WhatsApp's built-in flow (Settings → Account → Change number) rather than deactivating the old account. It transfers your chat history, groups, and PIN to the new number in one step, and the old account is automatically closed. Keep the SIM for your old number active until the move completes, because WhatsApp verifies the change by sending an SMS to the new number.
Choosing a PIN You Will Actually Remember
The PIN you choose today is the PIN you must recall months later, possibly mid-panic, on a screen with a blinking cursor. Reusing your phone's lock code is a common instinct and a bad one — the two numbers protect different things, and a thief who shoulder-surfs your lock screen learns both. Birthdays, years, and 123456 variants are the first things anyone guessing will try, and WhatsApp's anti-guessing measures only kick in after the damage of many wrong attempts.
Instead, build a mnemonic: take a phrase that matters to you, like "green door in August", and turn it into digits — G=4, D=3, A=8, giving 438. The point is not cryptography-grade entropy; it is that the PIN is unique, non-obvious, and recoverable from a memory you cannot lose. Write the PIN down in your password manager alongside your WhatsApp-relevant notes, not in a notes app on the phone you use for WhatsApp — the classic place a PIN gets lost with the device that holds it.
Switching Phones: A Complete Walkthrough
Moving WhatsApp to a new phone with two-step verification enabled is straightforward, but the order matters. Install WhatsApp on the new device, verify your phone number with the SMS code, and WhatsApp will ask for your two-step verification PIN before the account is fully registered. Enter it, and the account is yours on the new hardware; chats restore from your Google Drive or iCloud backup if you have one configured.
The pitfall is doing this with a forgotten PIN. Without a recovery email, the 7-day wait starts the moment you attempt registration, and you cannot use WhatsApp on the new device during that time — the old phone keeps working, so do not wipe it while the wait runs. With a recovery email, the reset link arrives immediately. Either way, the fix for a forgotten PIN is planning: set the email during the initial setup, not after you need it.
WhatsApp Business and Multi-Number Accounts
WhatsApp Business works the same way, but the stakes are different: a hijacked business number can redirect customer orders, impersonate your brand, and damage a reputation that took years to build. Enable two-step verification on the business app the day you create the account, and use a PIN distinct from your personal one so a compromise of one number does not leak the other.
If you run several numbers on one phone through WhatsApp's multi-account feature, each number carries its own PIN and its own recovery email. The app will prompt for the PIN belonging to the number being registered — a common source of confusion when people enter their personal PIN for a business number and hit a hard limit of wrong guesses. Label the PINs in your password manager by number, not by app.
Questions About WhatsApp Two-Step Verification
Does the PIN protect my chat history? No — the PIN guards the account registration, not the chats themselves. Chat backups on Google Drive or iCloud are protected by your cloud account credentials, so those accounts deserve their own strong security.
Can I use an authenticator app with WhatsApp? No. WhatsApp deliberately uses its own PIN system rather than standard TOTP, so there is no QR code to scan and no authenticator app integration.
If I change my number, does the PIN follow? Yes — the Change number flow transfers your account, chats, and PIN to the new number in one step, and the old account is closed. You will still need to verify the new number by SMS during the move.