WhatsApp is one of the most popular messaging apps, with over 2 billion users worldwide. In recent years, WhatsApp has focused on improving the security and privacy of its users’ communications. One of the key security features introduced by WhatsApp is the additional layer of security, which provides end-to-end encryption for messages and calls.
What is end-to-end encryption?
End-to-end encryption ensures that messages and calls are secured with lock and key, and no third party can access the decryption keys except the sender and recipient. This means that not even WhatsApp or its parent company Facebook can read users’ messages or listen to calls.
Here’s how end-to-end encryption works on WhatsApp:
- When you send a message to someone, your WhatsApp client encrypts the message using the recipient’s public key before transmitting it.
- The message remains encrypted until it reaches the recipient’s device where it gets decrypted using their private key.
- This private key is stored only on the recipient’s device and is not shared with anyone, not even WhatsApp.
- Similarly, any calls made on WhatsApp are also end-to-end encrypted so no third party can tap into the call.
This ensures conversations remain truly private and secure between the sender and recipient.
When was end-to-end encryption introduced on WhatsApp?
WhatsApp enabled end-to-end encryption across its platform in 2016. This means all texts, voice messages, video calls, images, GIFs, documents and downloads sent via WhatsApp are fully encrypted.
Prior to 2016, WhatsApp used transport layer encryption which encrypted messages between the sender and WhatsApp’s server. However, the messages were unencrypted on WhatsApp’s servers. This meant that while messages were encrypted in transit, WhatsApp still had the technical ability to decrypt them if required.
With end-to-end encryption, WhatsApp no longer has the means to decrypt users’ messages itself.
How does the additional layer of security work?
The additional layer of security refers to an optional feature that provides users with an extra passphrase to help secure their WhatsApp account. Here’s how it works:
- Users can choose to enable the additional security layer from WhatsApp’s privacy settings.
- They will be prompted to create a 6-digit PIN which is required to register their phone number with WhatsApp on that specific device.
- In addition, they can also create a password that is used to verify their identity before accessing WhatsApp on a new device.
- This password is locally stored on the user’s device and is not known to WhatsApp.
If the user tries registering their phone number on a new device, they will be prompted for the 6-digit PIN first. Only after entering the correct PIN can they access WhatsApp.
Additionally, when accessing WhatsApp on a new device for the first time, users have to enter their password before they can use WhatsApp. This adds an extra step to prevent unauthorized access.
Why is the additional security layer important?
The additional security layer is important because it prevents unauthorized access to a user’s WhatsApp account, providing enhanced security, especially in these cases:
- New device registration: Entering the PIN prevents others from registering your number on another device without authorization.
- Lost/stolen phones: If you lose your phone, the password will prevent access to your WhatsApp account on a new device.
- SIM card hijacks: If someone tries to hijack your SIM card and take over your WhatsApp, they won’t be able to verify with the PIN/password.
It also adds critical account protection in case your primary authentication method (your phone number) is compromised.
How secure is the additional security layer?
The additional security layer is quite robust since it uses the following security measures:
- The 6-digit PIN is randomly generated and not tied to any personal user data.
- The password chosen by the user is locally encrypted and not known to WhatsApp.
- Brute-force protection limits PIN guesses and enables automatic temporary locks after several failed attempts.
- PIN and password both have a minimum length requirement for added complexity.
- All verification SMS codes are still required as an additional authentication factor.
However, users should still follow best practices for using PINs and passwords by:
- Avoiding weak, easy-to-guess passwords based on personal info or consecutive/repeated numbers.
- Not sharing their PIN or password with others.
- Enabling all available authentication factors provided by WhatsApp.
How to enable the additional security layer
Enabling the additional security layer is simple:
- Open WhatsApp and go to Settings > Account > Two-step verification > Enable.
- Enter a 6-digit PIN and confirm it when prompted.
- You can also choose to enter your email address for added security.
- On the next screen, create and confirm your password.
That’s it! The next time you register your number with WhatsApp on a new device, you’ll need to enter this PIN. And when accessing your WhatsApp account for the first time on a new device, you’ll be prompted for the password you created.
What if you forget your PIN or password?
Don’t worry if you forget your 6-digit PIN or password for WhatsApp’s additional security layer. There are ways to recover access to your account.
If you forget your PIN:
- When prompted for the PIN on a new device, tap Forgot PIN.
- You will have to enter the phone number for your WhatsApp account and tap Next.
- WhatsApp will send a 6-digit verification code via SMS to reset your PIN.
If you forget your password:
- When prompted for the password on a new device, tap Forgot Password.
- You will have to enter the phone number linked to your WhatsApp account to receive a verification code.
- After verification, you can reset your password.
As long as you have access to the phone number for your WhatsApp account, you can reset the PIN and password through SMS verification.
Can you disable the additional security layer?
Yes, users can disable the additional security layer when they no longer wish to use it:
- Go to WhatsApp Settings > Account > Two-step verification.
- Tap Disable and confirm your selection.
Disabling the feature will remove the requirement to enter a PIN or password when registering your phone number or accessing WhatsApp on a new device.
Conclusion
WhatsApp’s additional layer of security provides robust account protection through an optional 6-digit PIN and password. It prevents unauthorized access if your phone number is compromised and also secures your WhatsApp account on new devices.
While WhatsApp’s end-to-end encryption already secures messages and calls from third-party access, the two-step verification feature offers an added layer of security for your actual WhatsApp account itself. For optimal security, users are highly recommended to enable this option in their WhatsApp settings.