WhatsApp for Android tests passkeys for on-device backup encryption: Report

WhatsApp's beta for Android adds a passkey feature to let users secure on-device backups with passkeys, stored in password managers and verified via biometrics

WhatsApp is evaluating passkeys integration to encrypt on-device data backups on Android devices. According to the platform update tracker WABetainfo, the passkey integration will allow users to encrypt their backups taken on-device with a passkey, providing a more secure and convenient way to protect conversations and media. Passkeys add an extra security layer, keeping encrypted files safe while making authorised access easier.

 

The feature is currently available to select beta testers and is expected to roll out to more users in the coming weeks.

WhatsApp’s Passkey security: How it works

As per the report,  the passkey option adds an extra layer of protection for backup data. Unlike traditional passwords, passkeys are securely stored in the user’s password manager and automatically accessible on trusted devices linked to the same account. This eliminates the need to memorise or manually manage long passwords, while maintaining strong encryption.

 

It is to be noted that the passkey for encrypted backups is separate from the passkey used to access the WhatsApp app itself. This separation ensures that each layer of security remains independent, with multiple passkeys available for different features if needed.

 

Previously, WhatsApp users could encrypt backups with a custom password or a 64-digit encryption key. While effective, this approach required remembering or safely storing the password. Many users reported losing access to backups after forgetting their passwords. With passkeys, authentication is handled automatically via Android APIs and integrated password managers. Users can confirm their identity using familiar methods, including fingerprints, facial recognition, or device PINs, making backup restoration faster and more secure.

 

The passkey system also supports seamless device transitions. While switching to a new Android device, users can restore encrypted backups as long as the same password manager is used, without manually entering complex passwords. This ensures encryption remains intact while simplifying the setup process. 

 

What are passkeys

 

Passkeys are a modern alternative to traditional passwords, allowing users to authenticate using biometrics like fingerprints or facial recognition, or a device PIN. They work with two components: one stored on the website’s server and the other on the user’s device. Even if the server is compromised, an attacker would still need the device to gain access, making passkeys highly secure. As a result, passkeys are resistant to phishing and provide a more secure authentication method that works across devices supporting biometric or PIN-based logins.