How to Turn On Two-Step Verification in WhatsApp

To turn on two-step verification in WhatsApp, go to Settings → Account → Two-step verification, tap Turn on, set a six-digit PIN, and add a recovery email — it takes under a minute and is the single best thing you can do to protect your account. Here is the full walkthrough for Android and iPhone, plus what the PIN does and how to recover it if you forget.

Why two-step verification matters

Your WhatsApp account is tied to your phone number. If a fraudster manages to take over your number — through a SIM swap or by tricking your operator — they could try to register WhatsApp as you. Two-step verification blocks that, because they would also need your private six-digit PIN, which never leaves your head. For anyone in India worried about SIM-swap scams, this is a quick, free defence worth turning on today.

Step-by-step: enabling the PIN

1. Open WhatsApp. On Android, tap the three-dot menu in the top-right and choose Settings. On iPhone, tap Settings at the bottom-right.
2. Tap Account (the key icon).
3. Tap Two-step verification, then Turn on.
4. Enter a six-digit PIN, then re-enter it to confirm.
5. Add a recovery email address, confirm it, and tap Done.

Once enabled, you will see a confirmation and the feature will show as on.

Choosing a PIN you will actually remember

Pick six digits that mean something to you but are not obvious to others. Avoid your birth year, your phone number, or a simple sequence like 123456. Do not reuse a banking or UPI PIN. Because WhatsApp will occasionally ask you to enter this PIN, you will get natural reminders that help keep it fresh in your memory.

Adding a recovery email (do not skip this)

The recovery email is your safety net. If you ever forget the PIN, WhatsApp can email you a reset link. Note that WhatsApp does not verify the email address when you add it, so type it carefully — a typo here means the reset link would go nowhere. If you skip the email entirely and later forget your PIN, you will have to wait a full seven days before you can reset it and use WhatsApp on a new device.

When WhatsApp will ask for the PIN

You will not be asked every time you open the app. WhatsApp requests the PIN in two situations:

1. Periodically, so the PIN stays in your memory — this is normal and not a sign of anything wrong.
2. Whenever your phone number is registered on a new phone, which is exactly the moment that stops an attacker.

Why the PIN matters more than ever

SIM-swap and number-takeover scams work by getting control of your phone number and then registering your WhatsApp elsewhere. Without two-step verification, that is often all an attacker needs. With it, they hit a wall: the six-digit PIN that only you know. This is why security guidance consistently recommends turning it on, and why it is worth the minute it takes. It is a one-time setup that quietly protects you every day afterwards, whether you are on a Jio, Airtel or any other connection.

Two-step verification is not the same as WhatsApp lock

People sometimes confuse two features. Two-step verification protects your account when your number is registered on a new device. A separate App Lock setting (under Settings → Privacy → App Lock on iPhone, or fingerprint lock on Android) stops someone opening WhatsApp on your unlocked phone. For full protection, it is worth using both: two-step verification against number takeover, and app lock against a snooping bystander.

What it does not protect against

Be clear-eyed about the limits. The PIN stops someone re-registering your number, but it does not stop scam messages, phishing links, or someone reading messages on a phone you left unlocked. Never share your six-digit PIN or the 6-digit registration code that WhatsApp sends by SMS — WhatsApp staff will never ask for either, and a common scam is a “friend” asking you to forward a code you just received. Treat both codes as private.

Turning it off or changing the PIN

You stay in control. Return to Settings → Account → Two-step verification at any time to Change PIN, Change email address, or Turn off the feature. That said, leaving it on is strongly recommended for everyone, and it costs nothing to keep active.

Android and iPhone: the path is the same

You will find two-step verification in the identical place on both platforms: Settings → Account → Two-step verification. The only difference is how you reach Settings — the three-dot menu on Android, or the Settings tab in the bottom bar on iPhone. The six-digit PIN, the optional recovery email, and the periodic prompts all behave the same way, so there is nothing extra to learn if you switch phones later.

To keep your account safe end to end, pair this with our guide on transferring WhatsApp to a new phone, where the PIN comes into play, and backing up and restoring WhatsApp chats so a lost phone never means lost messages. For privacy controls, see how to hide your last seen on WhatsApp.