WhatsApp is one of the most popular messaging apps available, used by over three billion users worldwide. It offers an easy way for people to stay in touch with friends and family without having to pay steep roaming charges for a quick text message or a short call. WhatsApp is known for encrypting messages, offering a safer way to communicate. However, risks like account takeover and device theft can still compromise users’ sensitive data. Let’s see if WhatsApp is safe and what you can do to secure your private conversations.
Contents:
How safe is WhatsApp?
WhatsApp is generally considered a safe app for direct communication. It uses the open-source Signal protocol to provide end-to-end encryption to all data transmitted over the app, including text messages, voice notes, calls, photos, and videos. This means that all data you send is converted into unreadable code while in transit and only decrypted once it reaches the recipient’s device.
As a web-based messaging app, WhatsApp lets you back up your chat histories in the cloud. This lets you maintain your data when you swap devices. Based on your phone model, you can choose to back up your data to iCloud or Google Drive. However, the backup data is not encrypted by default. You can opt in to encrypted chat backups to protect your data in case you lose your device. If you choose to encrypt your backup, WhatsApp and your storage provider won’t be able to access it.
WhatsApp has dedicated privacy settings that let you control who can contact you and access your personal information. You can choose to prevent calls and messages from unknown contacts, limit who can add you to groups, and block specific numbers from messaging you. You can add a biometric lock to the app to prevent others from opening it.
WhatsApp’s security features include IP protection and disappearing messages. You can protect your IP address by relaying your calls through WhatsApp’s servers and set up disappearing messages for private conversations.
WhatsApp also has built-in security tools to automatically detect and remove spam accounts before they can contact you. The platform requires all users to verify their identity in case it detects a suspicious login attempt. If you detect issues with your account, you can start a chat with the WhatsApp support team directly in the app.
Compared to standard SMS messages, WhatsApp’s security features are more reliable. Text messages are usually transmitted unencrypted over cellular networks, which can be intercepted by malicious parties. WhatsApp messages are transmitted over the internet, and users can switch on a VPN to additionally encrypt their traffic. Although some carriers can automatically detect and block spam text messages, SMS communication is generally less secure than WhatsApp’s.
| Standard SMS messaging services | |
|---|---|
| No message encryption | End-to-end encryption |
| Visible at all times and can be intercepted in transit | Decrypted at the sender’s and receiver’s endpoints |
| Transmitted over cellular networks | Transmitted over the internet |
| Metadata is fully accessible to carriers | Some metadata is accessible to Meta |
| No native backup | Cloud backup |
| No additional authentication | Two-factor authentication (2FA) |
Privacy landscape: The Meta account ecosystem and WhatsApp’s metadata
WhatsApp is part of the Meta account ecosystem. If you have accounts on other Meta platforms, like Facebook, Instagram, or Threads, you can connect them using the Meta Accounts Center. This lets you access and manage your account information more easily in a centralized space.
WhatsApp shares some similarities with Meta’s other messaging service, Facebook Messenger. Both platforms secure conversations with end-to-end encryption. However, WhatsApp offers more privacy-focused features, like disappearing messages and passcode-protected access to all chats. In the overall Meta ecosystem, WhatsApp is the safer option for private communication.
Despite the privacy-focused features, being part of the Meta ecosystem means the company gathers and tracks WhatsApp’s metadata. This includes information like IP addresses used to access the app, users’ phone numbers, location data, contact lists, and usage frequency, but excludes the content of the messages and calls. In some countries, WhatsApp data is shared with other Meta companies. However, due to the GDPR, this policy does not apply to users in the EU, EEA, and UK.
For users in countries where Meta can share WhatsApp data with its other internal companies, the metadata can be used to build more targeted ad profiles. For instance, users may get ads based on their WhatsApp location data.
Level up your online security
Store and manage your digital valuables safely
WhatsApp’s security risks and hidden threats
Despite its secure data transmission and account protection measures, WhatsApp is susceptible to some data breach threats. The biggest risk is your actual device being compromised — if someone steals your phone and opens the WhatsApp app, they can see your messages in plaintext. Other risks are related to common phishing attacks that try to hijack your account details.
Stolen device with an active WhatsApp session
Unlike other similar platforms, WhatsApp doesn’t offer a straightforward way to log out of the app. It continues to build its metadata until you remove the account or uninstall the app from the device. In some cases, this can create a safety concern — if your phone is stolen, criminals don’t need to manually log in to the app and can access all data available on it at the time. In that case, you need to download WhatsApp on another device and log in to your account. This automatically cancels the session on your original phone.
Scam messages
To contact you on WhatsApp, other users need to know your phone number. If you don’t have their number saved, these messages will appear as requests. Criminals can take your phone number from previous data breaches and try messaging it on WhatsApp to check if you have an active account. They then send you scam messages containing links to phishing websites. If you open the spoofed website, you might be asked to input sensitive information, like your banking details, which the hackers are trying to steal.
Account takeovers and SIM swapping
Cybercriminals can also attempt to access your WhatsApp account using SIM swapping attacks. They can contact you pretending to be a phone carrier and claim your SIM card is faulty, forcing you to take out a new one. Knowing the details of the new SIM card, they can intercept your messages and calls. Once you update your account details with the new number, the criminals can receive the text message with the WhatsApp verification code and use it to log in to the account before you get the chance.
Zero-click exploits
Criminals sometimes take advantage of in-app vulnerabilities to gain access to devices. Zero-click exploits take place when a hacker invites you to a WhatsApp group and sends you a malicious file. If you have auto-download set up, the app processes the file in the background without you directly interacting with it and stores it internally on your device. The malware can then run unnoticed, stealing data directly from your phone.
How to make your WhatsApp account safer
Although suspicious WhatsApp accounts get flagged quickly and you might go months without ever receiving a message from an unknown sender, you might still want to reinforce your account in case your device is lost or stolen. You can adjust most account security preferences in the WhatsApp settings.
1. Enable passkeys
The default method for WhatsApp users to verify their login attempts is by receiving a verification code via SMS. However, considering the risks of SIM swapping, you might want to choose a more reliable method, like passkey authentication.
Passkeys offer a secure and easy way to log in to your WhatsApp account. You can use your biometrics or your screen lock pattern to open the app and access your data. Once set up, WhatsApp will require your authentication device to match your passkey’s private and public keys. You can set up a passkey using NordPass and access it even when you swap devices.
2. Set up backups
Setting up automatic backups with end-to-end encryption helps you ensure your chat logs and media are available even if you’re forced to delete the app or lose your device.
You can set up encrypted backups in the WhatsApp settings:
Launch WhatsApp and tap the kebab menu at the top-right corner.
Select “Settings.”
Open the “Privacy” tab and select “Privacy checkup.”
Tap “Add more privacy to your chats.”
Select “End-to-end encrypted backups.”
You can choose to use a passkey, a password, or a 64-digit encryption key.
If you’ve selected a passkey, follow the instructions on your phone using your preferred passkey storage.
If you’ve selected an encryption key, generate and save the codes. Then, tap “Create.”
If you’ve selected a password, enter the combination and select “Create.”
To reinforce encrypted backup, you can set up a secondary encryption method using one of the remaining two options.
3. Review privacy settings
Tighten your app’s privacy settings to prevent suspicious contacts from spamming you with phishing messages and calls:
Open WhatsApp and tap the kebab menu at the top-right corner.
Select “Settings.”
Open the “Privacy” tab.
First, select “Groups” and choose “My contacts” to prevent unknown users from adding you to new groups.
Select “Live location” and, if you’re sharing it, tap “Stop sharing.”
Select “Calls” and toggle on “Silence unknown callers.”
Select “App lock” and switch on “Unlock with biometric” to secure your access to the app.
Select “Chat lock” and set up a secret code to protect your chat list.
Once you’ve adjusted the general privacy preferences, you can move on to advanced settings:
In the “Privacy” tab, tap “Advanced.”
Toggle on “Block unknown account messages” to stop unknown accounts from contacting you.
Toggle on “Protect IP address in calls” to make it harder to track your location.
Toggle on “Disable link previews” to protect your IP address from being inferred by third-party websites.
If you suspect that your account is at risk of a cyberattack, enable the “Strict account” mode for maximum privacy.
You can also adjust some optional settings in the “Privacy” tab:
Open the “Privacy” tab.
Under “Last seen and online,” check “Nobody” to prevent users from seeing your activity.
Under “Profile picture,” select who can see it. You can limit it to all contacts, exclude some contacts, or prevent everyone from seeing it.
Under “About,” select who can see your profile description.
Under “Links,” select who can view links attached to your profile.
Under “Status,” you can adjust who can see and share your status. You can also choose to reshare it on your connected Facebook and Instagram accounts.
You can toggle off “Read receipts” to prevent other users from knowing when you’ve checked their messages.
If you use disappearing messages, you can adjust the timer from 24 hours to 90 days.
If you have issues adjusting any of these settings, you can contact WhatsApp support via the live chat in the app.
If you haven’t reviewed your settings in a while, you can conduct a privacy checkup. Open the “Privacy” tab and select “Privacy checkup.” From here, you can review your contact settings, blocked users, personal information, and chat privacy settings. You can also add two-factor authentication, a passkey, or a recovery email.
4. Switch off automatic downloads
Having automatic file downloads set up can expose your device to zero-click threats. In the app settings, you can turn this feature off to save your data and prevent undetected malware downloads:
Launch WhatsApp and tap the kebab menu at the top-right corner.
Select “Settings.”
Tap “Storage and data.”
Under “Media auto-download,” toggle all options (“Mobile data,” “Wi-Fi,” and “Roaming”) to “No media.”
5. Secure your associated accounts
If your WhatsApp account is connected to the Meta Accounts Center, you might want to protect other connected accounts within that ecosystem. Change your Facebook, Instagram, or other Meta account password and set up two-factor authentication for a safer login.
Check which online profiles require your phone number, and remove it if possible. Delete your phone information from any platform where it’s unnecessary to prevent it from being compromised in data breaches or sold to third parties.
If you’ve set up a password for your WhatsApp’s end-to-end encryption chat backup, make sure you’re not using it for other accounts. Keep all your passwords unique — this helps lower the chances of your accounts being breached during cyberattacks.
How NordPass helps secure your WhatsApp account and other credentials
Unlike conventional social media platforms, WhatsApp doesn’t use standard username-and-password credentials to log in. Instead, it requires your phone number for confirmation. Once you’re in the app, you can set up passkeys and secure codes to protect access to your sensitive data. NordPass offers handy features to ensure WhatsApp’s security access points remain protected:
Secure password and passkey storage. NordPass lets you store passwords and passkeys in your personal XChaCha20-encrypted vault. All credentials are synchronized across devices, letting you easily log in using your preferred method wherever you are.
Strong password generation and smart autofill. You can use NordPass to generate strong and unique passwords for all accounts. If you’re creating a new account, NordPass will detect the password field, suggest a generated password, and let you save it to your vault with a click. Whenever you need to log in, you can do so quickly using autofill. This feature also recognizes the legitimate website's URL and won't autofill your details on a phishing site.
Protected access to chat backup. WhatsApp lets you secure your chat backup with end-to-end encryption. You can use a passkey, a password, or a 64-digit encryption key to secure this access. Whichever method you choose, NordPass can keep it safe. You can generate a password, save the passkey, or store your encryption key as a secure note in the vault.
Convenient two-factor authentication. To protect access to your WhatsApp account, you should add 2FA on the app by setting up a six-digit PIN. You can save this PIN in your NordPass vault as a secure note. If you want to set up two-factor authentication on other Meta accounts, you can use the NordPass Authenticator to generate reliable one-time codes.
Dark web monitoring. Sometimes data breaches can go unnoticed. With NordPass’ Data Breach Scanner, you can set up monitoring for your credentials and get instant alerts if it detects a data match on the dark web. Data Breach Scanner helps you react to threats quickly and reinforce your personal data protection.
Bottom line
As far as encrypted messaging apps are concerned, WhatsApp is safe for private conversations and calls. However, its safety doesn’t rely solely on its end-to-end encryption protocol — we recommend you set up 2FA and encrypted backup to keep your private data secure.