WhatsApp two step verification adds a six-digit PIN to your account, so a stolen SMS code alone cannot take it over. It takes about two minutes to set up. Many people still skip it, which is a risk when scammers keep trying to trick users into sharing codes.
Quick answer
- Path: Settings, then Account, then Two-step verification, then Enable.
- You create a six-digit PIN and confirm it.
- Add an email address so you can reset the PIN if you forget it.
- The PIN is separate from the six-digit SMS code WhatsApp sends when you register.
- WhatsApp asks for the PIN when you register on a new phone, and now and then in the app.
How WhatsApp two step verification works
When you register WhatsApp on a phone, the app sends a six-digit code by SMS or phone call. Anyone who gets that code can try to register your number on their own device. Two step verification adds a second lock, so the SMS code is not enough.
According to WhatsApp’s help centre, the PIN is separate from the registration code. It is optional, and WhatsApp reminds you of it from time to time so you do not forget it. If you do forget it, WhatsApp can email you a reset link, but only if you added an email address earlier.
Steps to turn on two step verification on Android
- Open WhatsApp and tap the three dots at the top right, then Settings.
- Tap Account, then Two-step verification.
- Tap Enable.
- Choose a six-digit PIN and enter it again to confirm.
- Add an email address for recovery, or skip it if you must.
- Tap Save and finish.
If you do not see the option, update WhatsApp from the Play Store first. Menu names can differ slightly between versions, but the path stays close to this.
Steps to turn it on with an iPhone
- Open WhatsApp and tap Settings at the bottom.
- Tap Account, then Two-step verification.
- Tap Turn on or Set up PIN.
- Enter a six-digit PIN and confirm it.
- Add an email address for recovery.
- Tap Done. If you added an email, enter the code sent to it to complete the step.
Why you should add a recovery email
This is the step people skip, and it is the one that matters most later. Without an email, there is no simple way to reset a forgotten PIN. How-To Geek also advises against skipping it for this reason.
Use an email account that you already protect well. For example, an address with its own strong password and a second step is a good choice. A throwaway or shared inbox is not.
Common mistakes to avoid
First, do not pick an easy PIN such as your birth year or 123456. The PIN should be different from your phone’s lock code, so one leak does not expose both. Next, never share the PIN with anyone, including people who claim to be WhatsApp support.
Also, do not confuse the two codes. The SMS code is for registering. The PIN is for protecting the account. A message asking you to forward either one is a red flag.
If you think you were tricked into sharing a code, act quickly. Our guide to the cyber fraud golden hour and the 1930 helpline explains what to do next. For wider account safety, you can also read about how to lock Aadhaar biometrics.
How to change or turn off the PIN
You can change the PIN or the recovery email from the same screen at any time. You can also switch the feature off there. However, turning it off removes the extra lock, so it is better to change the PIN than to disable it.
Steps follow the path in WhatsApp’s own two-step verification help page, and menus can change after app updates.
FAQ
Is WhatsApp two step verification mandatory?
No. It is an optional feature. Still, it is worth enabling because it protects your account if someone gets your SMS code.
What if I forget my WhatsApp PIN?
If you added an email address, WhatsApp can send a reset link there. Without an email, resetting is harder, so add one now.
Will it protect me from every scam?
No. It blocks account takeover through a stolen SMS code, but it does not stop scam messages. Never click unknown links or share codes, even with a contact whose account looks familiar.