Every WhatsApp user in Pakistan knows the moment: new phone, fresh install, and the six-digit SMS code takes twenty minutes to arrive — or does not arrive at all, because you are travelling, roaming, or your network is having a day. A passkey is WhatsApp’s answer: after a one-time setup, you can verify yourself with your fingerprint, face or screen lock instead of waiting for the code.
Passkeys launched on Android in October 2023 and on iPhone in April 2024, and by August 2026 WhatsApp said more than 1 billion people use one. This guide covers setup, requirements, and — most importantly — how a passkey is different from the SMS code and from two-step verification, because confusing the three is where accounts get lost.
What a Passkey Actually Is
WhatsApp describes passkeys as “a secure alternative to SMS verification codes”: instead of a code sent to your number, you log back in using your device’s built-in security. Technically, a passkey is a cryptographic pair — a public key held by the service and a private key that lives on your device and, in WhatsApp’s words, “can’t be written down or given away.” Because there is no code to type, there is nothing for a scammer to trick out of you on a fake page or a phone call — that is what “phishing-resistant” means in practice.
One privacy point WhatsApp states directly: “Your biometric data, such as your fingerprint or face, never leaves your device.” The fingerprint check happens locally; WhatsApp receives only proof that it passed.
Set Up Your Passkey (Android and iPhone)
- Open WhatsApp → Settings.
- Tap Account → Passkeys.
- Tap Create passkey → Continue (on iPhone the same screen leads with Continue).
- If prompted, tap Use screen lock and confirm with your fingerprint, face or PIN.
- WhatsApp saves the passkey in your default password manager — on Android, Google Password Manager (on Samsung phones the dialog defaults to Samsung Password Manager, with a “Save Another Way” choice); on iPhone, iCloud Keychain, where it is available on all your Apple devices.
Creating a passkey takes under a minute. If the Passkeys menu does not appear, update WhatsApp from the Play Store or App Store first — guides quoting exact “required version numbers” disagree with each other, and WhatsApp does not publish one; the update is the fix.
Requirements
| Android | iPhone | |
|---|---|---|
| Minimum | Android 9 or later | iPhone 8 or newer, iOS 16 or later |
| Screen lock | Must be set up | Must be set up |
| Account | A password-manager account linked to the device (Google account in Google Password Manager, or Samsung account in Samsung Password Manager) and Password Manager enabled | iCloud Keychain (saves automatically) |
Two corrections to early coverage: some launch reports claimed iOS 17 or iPhone XR as the minimum — WhatsApp’s Help Center says iPhone 8+ and iOS 16+, and that is the figure to trust. And no source puts an email address in the passkey requirements — email appears only in two-step verification recovery (below). For Pakistan specifically, a local guide applying the same Help Center steps found no Pakistan-specific exclusion: most phones sold here with a Google account already have Google Password Manager ready.
When You Will Actually Use It
A passkey is used at registration moments: reinstalling WhatsApp, moving to a new phone, or restoring your account. If you previously created one, WhatsApp may offer the passkey at registration instead of the SMS code — tap, confirm with your screen lock, done. WhatsApp’s Help Center pitches exactly the Pakistani pain points: passkeys help “when traveling internationally or dealing with carrier issues” where you might be “unable to receive the 6-digit code.”
Just as important: the SMS code is not deleted. A passkey is opt-in; the six-digit code remains available as a fallback, and you can ignore passkeys entirely and keep using SMS. Passkeys also do not cover linked devices — WhatsApp Web, Windows and Mac still join by QR code scanned from your phone, because a linked device cannot be a primary device.
Three Different Locks: Do Not Confuse Them
This is the section that protects your account, because all three protections are regularly mixed up:
| Protection | What it is | When it is asked |
|---|---|---|
| SMS registration code | One-time 6-digit code sent to your number | When you register your number on a device |
| Two-step verification | A secret you choose | Periodically, and whenever your number is re-registered |
| Passkey | Fingerprint/face/screen-lock credential stored in your password manager | Offered instead of the SMS code at registration |
And the August 2026 update that changed the middle row: two-step verification, long a six-digit PIN, was upgraded by WhatsApp to a full password — “longer, alphanumeric, and even with special ch@racters to make it harder to guess.” The same announcement added multiple passkeys per account (below). The changes are not forced: accounts still using an old PIN, or no passkey, stay exactly as they are until the user upgrades.
WhatsApp and independent coverage agree on the key relationship: the passkey and two-step verification are separate, and neither makes the other redundant — use both. If you upgrade your two-step secret to a password, add a recovery email: WhatsApp’s security guidance calls it the only way to reset that password if you forget it. One separate feature to keep apart from all of this: since October 2025, a passkey can also unlock your end-to-end encrypted chat backup (Settings → Chats → Chat backup → End-to-end encrypted backup) — a second use of the same technology, not the login passkey itself.
Multiple Passkeys (August 2026)
If you carry both an iPhone and an Android phone, one passkey used to be a problem: an iCloud Keychain passkey does not appear in Google Password Manager and vice versa. Since 25 August 2026, WhatsApp supports more than one passkey on a single account — create one per ecosystem, managed at Settings → Account → Passkeys, where the 1-billion-user announcement landed.
Delete or Change a Passkey
Settings → Account → Passkeys → Delete → Delete. (Older app versions labelled the same button Revoke — same action.) A passkey cannot be edited: to change one, delete it and create a new one. After deletion, registration simply reverts to the SMS code, which was never removed.
The Honest Limits
- SIM-swap: a passkey reduces your dependence on SMS codes — a remote attacker would also need your device or credential manager — but because SMS registration remains as a fallback, a passkey alone does not make a SIM-swap impossible. That protection job belongs to two-step verification. Anyone claiming a passkey “stops SIM-swap attacks” is overselling it.
- Your passkey is only as strong as your screen lock. Anyone who can unlock your phone can pass the passkey prompt. A passkey protects account registration; it does nothing for chats on an already-unlocked phone — that is what App Lock and Chat Lock are for.
- Lost phone: WhatsApp’s Help pages do not publish a guaranteed lost-passkey-phone recovery route. The mechanism that saves you is sync: the passkey lives in Google Password Manager or iCloud Keychain, so signing into the same Google or Apple account on a new phone should make it available — but treat that as how sync works, not a WhatsApp promise. Keep your SIM, your backup and two-step verification in order regardless.
- WhatsApp Business: no official source confirms or denies the Passkeys menu inside the Business app specifically. Business users should simply check Settings → Account in their own app — do not plan around it until you see it.
The passkey steps, requirements and the multiple-passkeys upgrade above follow WhatsApp’s Help Center guidance and its 25 August 2026 announcement, as reported by The Hacker News and security coverage of the same release.
Also read: Change Your WhatsApp Number Without Losing Chats or Groups · WhatsApp Chat Lock: Hide Private Chats With a Secret Code
FAQs
Q: I created a passkey — will WhatsApp still send me an SMS code on a new phone?
You may be offered the passkey at registration instead of the code, which is the whole point: confirm with your fingerprint, face or screen lock and skip the wait. But the SMS method is not removed — a passkey is an opt-in alternative, and the six-digit code remains as a fallback if the passkey is not offered or not available, for example on a device where your password manager is not signed in.
Q: Is a passkey the same thing as my two-step verification PIN?
No — they are three separate protections. The SMS code is a one-time six-digit code for registering your number. Two-step verification is a secret you choose, asked for periodically and at re-registration — and since August 2026 it can be upgraded from the old six-digit PIN to a full alphanumeric password with special characters. A passkey is a biometric/screen-lock credential stored in Google Password Manager or iCloud Keychain. WhatsApp states the passkey and two-step verification are separate and neither replaces the other, so keep both switched on.
Q: What Android and iPhone versions do I need in Pakistan?
Android 9 or later, with a screen lock set and a password manager linked to the device — a Google account in Google Password Manager (most phones sold in Pakistan already qualify) or a Samsung account in Samsung Password Manager. On iPhone: an iPhone 8 or newer running iOS 16 or later, with the passkey saved automatically to iCloud Keychain. No Pakistan-specific restriction appears in WhatsApp’s documented requirements.
Q: How do I remove a passkey, and what happens afterwards?
Open Settings → Account → Passkeys and tap Delete, then Delete again to confirm (older versions label the button Revoke). A passkey cannot be edited, so changing one means deleting it and creating a new one. Afterwards nothing breaks: registration simply falls back to the SMS six-digit code, exactly as it worked before you created the passkey.