WhatsApp introduced two-step verification in 2017. The optional security feature began rolling out to all users in February 2017 after months of beta testing.
Two-step verification adds a six-digit passcode to WhatsApp’s normal phone-number verification process. When users register their number on a new device, the account can require both the usual SMS or voice verification code and the passcode created in WhatsApp’s settings. Users can also add an email address to help recover access if they forget the passcode.
The feature is sometimes confused with end-to-end encryption, but they protect different parts of the service. End-to-end encryption protects message content while it travels between participants; two-step verification helps prevent someone who obtains control of a phone number or SIM from registering the account elsewhere. WhatsApp’s two-step verification is optional and was initially disabled by default. It also periodically asks users for their passcode as a reminder.