How WhatsApp Scaled Passkeys to Billions of Users: Inside the Security Overhaul

As the world’s largest messaging platform, WhatsApp serves billions of people globally, acting as an indispensable communication tool across deeply diverse regions, languages, and network infrastructures. Connecting such a massive audience requires not only extreme reliability and absolute privacy, but also a security framework that is both resilient against sophisticated cyber threats and accessible to users with varying levels of digital literacy. To meet these demands, the platform undertook a massive architectural transformation, becoming one of the first major consumer applications to integrate passkeys at scale.

The journey began in 2023, driven by the need to eliminate the vulnerabilities associated with traditional authentication methods. According to Mayank Manuja, an Android Engineer on the WhatsApp Registration and Access team who led the design and implementation of passkey-based authentication, the sheer scale of the platform is what made the project both compelling and challenging. Even a minor improvement to WhatsApp instantly touches billions of users worldwide, making security enhancements a delicate balancing act that must account for a vast range of device capabilities, network conditions, and user environments.

Building for an audience of this magnitude meant navigating numerous obstacles right from the start. Traditional authentication methods, such as SMS-based One-Time Passwords (OTPs), have long suffered from delivery inconsistencies in certain regions, leaving users temporarily locked out of their accounts. Furthermore, credential theft and phishing attacks continue to pose significant threats to consumer accounts globally. Recognizing the potential of next-generation authentication early on, WhatsApp committed to adopting passkeys to provide a fast, phishing-resistant alternative that drastically reduces user friction while offering robust protection against account takeovers.

The Decision to Adopt Passkeys

For a platform as ubiquitous as WhatsApp, offering multiple resilient access methods is crucial to ensuring that users can easily stay connected and reliably regain access when necessary. Passkeys represent a fundamental shift in how digital identity is verified, offering users a streamlined, one-tap login experience that completely eliminates phishing risks. Underneath the surface, passkeys leverage public-private key cryptography to replace manual credential entry with secure biometric checks or standard device screen locks.

This cryptographic workflow dramatically improves sign-in speeds by reducing the entire authentication process to a single tap via a unified, bottom-sheet interface that keeps users seamlessly engaged within the context of the application. The operational benefits are twofold: users receive a frictionless login experience, while the platform gains robust, native protection against credential-harvesting attacks. Crucially, because these cryptographic credentials are handled locally by the device’s operating system, they function reliably even in geographic regions where traditional SMS delivery systems experience bottlenecks or delays. Ensuring diverse and robust account access methods ultimately guarantees that users are rarely locked out of the communications they rely on every day.

Client-Side Integration and Engineering Challenges

From the perspective of WhatsApp’s engineering team, adopting the Credential Manager API provided a clean, unified interface that successfully abstracted away the immense complexity of managing underlying credential providers. Once the initial integration flows were mapped out, the API surface became straightforward, with credential creation and retrieval following well-defined request and response patterns.

However, achieving success at a global scale required more than just implementing the happy path. Navigating a wildly diverse user base spanning countless original equipment manufacturers, multiple Android operating system versions, and varied device configurations exposed unprecedented edge cases. Developers had to account for scenarios where users lacked configured screen locks, unexpected exception types, outdated Google Play Services, and inconsistent credential provider behaviors across different hardware ecosystems. To overcome these hurdles, engineering teams from WhatsApp and Google collaborated deeply to resolve exceptions, refine fallback mechanisms, and ensure a predictable experience regardless of the user’s specific hardware setup.

Refining the User Experience

Because passkeys represented an entirely novel concept for the general public when they were first introduced in early 2023, there were no established industry patterns for prompting users to create them. WhatsApp addressed this by deploying extensive A/B testing frameworks, developing contextual prompts specifically targeted at users who would benefit the most from upgraded security.

This strategy was iterative and continuous. As Android operating system flows matured into a streamlined, single-screen experience, WhatsApp correspondingly simplified its own interface prompts to avoid redundant steps or user confusion. The resulting setup flow allows users to establish a passkey with minimal interruption, turning what was once a multi-step chore into an effortless part of daily app usage.

Server-Side Architecture and Cross-Platform Hurdles

On the backend, WhatsApp’s infrastructure implements standard WebAuthn and FIDO2 ceremonies to manage user authentication securely. The server architecture is built using Erlang, which calls the Rust webauthn-rs library through a native interface. This specific Rust library efficiently handles complex cryptographic signature verification and credential parsing, allowing the internal Erlang code to remain lean and focused on core orchestration, storage, and product rules such as eligibility, rate-limiting, and the overall credential lifecycle.

The server architecture orchestrates these core cryptographic ceremonies through four primary entry points, paired into distinct begin and finish sequences for both registration and authentication. The passkey registration sequence handles issuing creation options to the client, verifying the cryptographic attestation once the client acknowledges a successful creation event, and securely persisting the credential in the database. Similarly, the credential authentication sequence handles the login process by orchestrating assertion verification after successful client authentication, while dynamically updating stored credentials whenever WebAuthn signals that a refresh is required.

Implementing this architecture at a massive scale presented unique structural challenges, particularly concerning account accountancy, session state management, and device synchronization across varied user ecosystems. Ashish Choudhary from the WhatsApp backend team noted that managing the lifecycle of multiple credentials per user while maintaining strict security boundaries required rigorous architectural discipline, especially when dealing with users who frequently switch or upgrade their mobile devices.

Rethinking Cross-Device Synchronization

This robust multi-passkey architecture also allowed the platform to completely rethink how cross-platform usability functions in practice. Standard WebAuthn cross-device flows typically require a user to scan a QR code on one device and authenticate over Bluetooth on another. However, WhatsApp’s engineering evaluation found this Bluetooth dependency to be frequently unreliable in field conditions, and users often confused the new authentication QR codes with the existing WhatsApp Web desktop-linking interface.

Rather than forcing a fragile cross-device transport mechanism, WhatsApp allows users to hold passkeys natively across multiple platform ecosystems, such as Google Password Manager on Android and iCloud Keychain on iOS. When users migrate between different mobile platforms, they simply generate a fresh passkey during their next standard sign-in. This pragmatic approach is completely frictionless for the end consumer and operates seamlessly on top of the underlying multi-passkey server infrastructure without introducing unnecessary connection vectors.

Looking Ahead and Recommendations for Developers

Since launching passkeys globally, WhatsApp has witnessed robust organic adoption across its vast user base. By successfully transforming a traditional, multi-step sign-in process into a single, frictionless biometric gesture, the platform has markedly improved overall user engagement and security hygiene. Building directly upon this momentum, the platform is now actively expanding passkey utility far beyond initial sign-in flows, exploring seamless in-app re-authentication for sensitive account actions, such as securing passkey-encrypted cloud backups.

Looking forward, the development teams are actively collaborating with broader platform partners to pioneer even lower-friction credential creation pathways, anticipating that structural barriers to entry will naturally diminish as hardware-level biometric capabilities continue to expand across global markets. For other development teams preparing to integrate passkeys at scale, the WhatsApp engineering group emphasizes the importance of designing flexible client architectures, anticipating diverse OEM edge cases, maintaining strict adherence to standard WebAuthn ceremonies, and prioritizing contextual user education over forced prompts. Through careful planning and deep cross-industry collaboration, the transition to credential-free authentication has proven not only viable for billions of users, but foundational for the future of digital security.