WhatsApp announced a significant upgrade to its security infrastructure, rolling out passkey support for its end-to-end encrypted chat backups. This new feature allows the platform’s more than three billion users to secure their cloud-stored chat history using the same simple biometric authentication such as a fingerprint, face scan, or device screen lock that they use to unlock their phones.
The move, announced in the company’s Blog Post on Thursday, is designed to solve a major usability challenge that has long plagued high-security systems: the trade-off between convenience and protection. By replacing complex passwords and unwieldy 64-digit encryption keys with intuitive, device-based passkeys, WhatsApp is making its most robust security feature accessible to millions of users who may have previously found it too cumbersome to enable.
This update reinforces the platform’s commitment to a password-free future and aims to plug what has been a persistent, if optional, vulnerability in its otherwise end-to-end encrypted ecosystem.
The Problem with the “Unforgettable” Key
In 2021, WhatsApp made a groundbreaking move by becoming the first major global messaging service to offer end-to-end encryption (E2EE) for chat backups stored on Google Drive and iCloud. While messages in transit have been E2EE on the platform since 2016, backups remained a potential weak link. If a user’s cloud account was compromised, their entire chat history could be exposed.
The 2021 update solved this by allowing users to lock their backup with a password or, for maximum security, a 64-digit encryption key. With this enabled, neither WhatsApp nor the cloud providers (Google and Apple) could access the contents of the backup.
However, this security came at a high price of convenience. The 64-digit key, while cryptographically impenetrable, is impossible for a human to memorize. Users who lost this key or forgot their chosen password would be permanently locked out of their own backups. This “massive friction point,” as described by security analysts, led many users to either forgo the feature entirely, leaving their backups unencrypted, or use simple, memorable passwords that defeated the purpose of high-security encryption.
“Many of us carry years of precious memories in our WhatsApp chats,photos, heartfelt voice notes, and important conversations,” the company stated in its blog post today. “That’s why protecting them if you ever lose your phone or need to transfer to a new device is so important.”
How Passkeys Change the Game
The new system addresses this dilemma by leveraging FIDO-based passkey technology, which is built directly into iOS and Android operating systems.
When a user enables the new feature, they will no longer be asked to create a password or save a long string of numbers. Instead, they will simply be prompted to use their device’s native unlock method. This could be their fingerprint, a facial scan via Face ID, or their standard device PIN or pattern.
This one-time setup links the encrypted backup to the user’s device biometrics. When the user needs to restore their chat history on a new phone, they will simply be prompted for the same biometric scan or PIN. The authentication happens locally on the device, providing a cryptographic “proof” that unlocks the backup without ever transmitting the user’s biometric data or a password over the internet.
This method offers the best of both worlds:
- High Security: Passkeys are resistant to phishing attacks and server-side data breaches, as there is no password to steal. The private key used for authentication never leaves the user’s device.
- Ultimate Convenience: The process is as simple and familiar as unlocking a phone. This dramatic reduction in friction is expected to lead to a massive increase in the adoption of encrypted backups, significantly enhancing the baseline privacy for billions of users.
A Phased Rollout and Broader Strategy
The passkey backup feature is not the company’s first foray into passwordless authentication. In 2023, WhatsApp began rolling out passkey support for account logins, allowing users to sign in without relying on the traditional 6-digit SMS code, which is vulnerable to SIM-swapping attacks.
This latest update extends that same philosophy to data storage, signaling Meta’s clear and aggressive strategy to eliminate passwords across its ecosystem.
According to the announcement, the feature for passkey-encrypted backups will be rolled out gradually to all WhatsApp users on iOS and Android “over the coming weeks and months.”
Users can check for the new option by navigating to Settings > Chats > Chat backup > End-to-end encrypted backup. If the feature is available on their account, they will see a new option to use a passkey, allowing them to upgrade from their old password or 64-digit key, or to finally enable the feature for the first time with a simple, secure tap.
For a platform that serves as the primary communication tool and digital memory box for a large portion of the globe, this change represents more than just a new feature. It is a fundamental enhancement to user privacy, making robust, impenetrable security the new, effortless standard for everyone.
