A six-digit PIN has exactly one million possible values [17]. WhatsApp's pitch for replacing it is guessing resistance: longer, alphanumeric, special characters permitted, with a nudge that anyone still using "123456" should move [4][5]. Take a six-character password over case-sensitive letters and digits and the space becomes about 56.8 billion values, roughly 56,800 times the PIN, before a single special character is counted [18]. None of the four accounts of the announcement mentions a minimum length or a complexity rule [21], so the ceiling has moved further than the floor.
The reason this is more than a settings tweak is the shape of a WhatsApp takeover. Accounts are closely tied to phone numbers, which makes the one-time verification code the thing worth stealing, whether lifted directly or talked out of the victim, according to CyberInsider [7]. The two-step secret is the hop after that, and until now it was six digits [4]. WhatsApp says two-step verification exists precisely to hold when someone already has the one-time passcode [6]. Passkeys avoid that path: authentication runs against the device fingerprint, Face ID or screen lock, with no separate code or PIN to type [8].
The multi-passkey change looks minor and is not. CyberInsider describes the account as previously supporting a single passkey [20], so anyone carrying an Android handset and an iPhone had one enrolled platform and a typed-code fallback on the other. Two enrollments remove the reason to keep the fallback warm. What no version of the announcement says is that the one-time code route has been retired [22], which means the phishing-resistant method is additive rather than exclusive, and the weakest enabled path still sets the account's real strength.
Most of what shipped this year aims at the user rather than the credential: Strict Account Settings in January for high-risk people such as journalists and public figures [13], warnings in March on device-linking requests that may be fraudulent [14], and an optional Scam Alert beta this month running a local machine learning model [15], alongside the new caller context on Android [10]. Those are all interventions at the moment of attack. Passkeys change what an attacker has to hold. The vendor report promoted under BleepingComputer's own coverage makes the matching point from the defender's side: across 338 million simulations in production environments, prevention falls off sharply once an intruder is using valid credentials [16]. Making valid credentials harder to obtain is the part of that curve a messaging app can touch.
