How to turn on two-step verification in WhatsApp
WhatsApp two-step verification adds a password or PIN to account protection after your number is registered. It does not replace the six-digit code used to confirm your phone number. That difference matters: scammers often ask for the registration code, while this extra layer makes it harder to finish account access without the credential you set.
WhatsApp says it is upgrading the six-digit PIN used for two-step verification to a password. Your screen may therefore refer to a PIN or password depending on your account and app version. The exact wording can vary, but the setting is managed from your account settings. Read WhatsApp's current guidance.
Know the difference between the two codes
A registration code can arrive by text message, phone call and, for eligible accounts that previously verified an email address, email during sign-in on a new phone. It confirms your number. Never share it. Two-step verification is the credential you choose, requested in certain re-registration situations as an extra barrier.
Creating a PIN does not make it safe to give away a texted registration code. If someone requests it through a message, call, or alleged support channel, stop the conversation. WhatsApp explicitly says not to share registration codes or passwords. Its registration guidance explains the distinction.
Turn it on in Android
- Open the official WhatsApp app and open the more-options menu.
- Go to Settings > Account > Two-step verification. The label may transition to a password option as WhatsApp rolls out its update.
- Choose to enable it and create a credential you can recover without reusing your email or Google Account password.
- Add an email address you control and complete the verification requested by the app. The email is a recovery safeguard, not a replacement for having your phone number.
- Review trusted devices and keep WhatsApp updated from the official store. Before installing a file sent in a message, understand what an unverified Android app means.
WhatsApp may ask for the credential occasionally. Do not dismiss those prompts or keep the password in a chat or screenshot. The point is to make sure you can still recall it before you need to move phones.
Choose a password that does not create another risk
Use a unique, long password stored in a reputable password manager. Avoid birth dates, number sequences, and the password used for your email. If the account still displays a PIN, do not send it to anyone; when a password upgrade is offered, use WhatsApp's own flow instead of installing third-party apps.
Your recovery email needs the same care. Confirm that you can access it now and that its inbox is protected. If you lose email access while still signed in on another phone, update the address in WhatsApp before replacing your phone. WhatsApp's help center notes that email changes can only be made from an active session. See the email and recovery rules.
When the registration code does not arrive
Do not cycle through guesses or ask strangers for codes. Check that the active SIM for your number is in the phone, the number was entered correctly, and the app's timer allows another request. Use a call only when WhatsApp itself offers it. Our WhatsApp verification-code troubleshooting guide puts those tests in a safe order.
Having an email on file can help only in scenarios WhatsApp describes; it does not remove the requirement for an active SIM with the same number. If you lost the line, contact your carrier to recover the number. Do not trust profiles that promise to unlock the account outside the app.
Phone changes and scam warnings
Before wiping the old device, make sure you remember the two-step credential, can access the saved email, and still control the phone number. Use the official transfer flow and keep one session available until the new phone works. This lowers the risk of getting stuck between a SIM change and recovery.
For a related access issue, see how to fix Instagram when it will not open on Android without losing access. Unexpected permission requests also deserve a pause; use the guide to dangerous Android permissions before granting access. Across apps, an urgent request for a code or password is a reason to stop and verify the official path.
Final check: I enabled the extra layer, verified an email I control, did not reuse a password, and know never to disclose a registration code.
Documentation checked on October 3, 2026. Menu labels can vary by platform, app version, and WhatsApp's staged updates.