Meta’s WhatsApp is rolling out a significant security upgrade for its billions of users, introducing passkey-encrypted backups for chat history on both iOS and Android. The new feature allows users to secure their cloud backups (on Google Drive or iCloud) using their device’s native biometric authenticators (fingerprint or Face ID) or their screen lock code.
This update is a landmark event in usable security. Previously, users who wanted to end-to-end encrypt their cloud backups faced a severe usability trade-off: they had to either set a password they could easily forget or manage a cumbersome 64-digit encryption key that was nearly impossible to remember. This high friction meant most users simply left their backups unencrypted, creating a massive privacy loophole. The new passkey method eliminates this human error by removing the trade-off between security and convenience.
The system links robust encryption to an action the user performs dozens of times a day: unlocking their phone. It relies on cryptographic key pairs, with the private key stored securely on the user’s device. This key never leaves the device, which prevents it from being exposed in a data breach. The system maintains full end-to-end encryption, ensuring that neither WhatsApp/Meta nor the cloud providers can access the contents of the backup.
The feature is rolling out globally “over the coming weeks and months”. Users can enable it by navigating to Settings > Chats > Chat Backup > End-to-End Encrypted Backup. This move is expected to mainstream the concept of passkeys for data recovery, building user trust in biometric-tied credentials for a passwordless future.
Sources: Meta Newsroom, Bitdefender, Mashable
—
By Ji-seo Kim
