WhatsApp Security Checklist

The default backups that WhatsApp creates to iCloud or Google Drive are NOT end-to-end encrypted. That means a court can compel Apple or Google to turn over your entire chat history. Even though your messages were sent securely, the backup defeats that protection by providing an easy way for your entire chat history to be revealed.

Disabling backups also protects you if a hacker breaks into your iCloud or Google account through phishing or a reused password.

If you absolutely need backups, see Securely back up your WhatsApp chats for how to do this safely.

By default, anyone you've ever exchanged messages with can see when you were last on WhatsApp. For activists, that's a low-effort way for someone to map your patterns of activity.

Enabling Strict Account Settings turns on a number of protections at once. It's a good default for anyone doing activism.

Enabling disappearing messages by default keeps you and your contacts safer if a phone is ever confiscated or breached. We don't know whose phone will be seized by law enforcement. Even if you believe you're talking about perfectly legal things, the government can find ways to twist your words.

WhatsApp's options are 24 hours, 7 days, or 90 days. 7 days is a good default to choose, and then you can manually set a shorter timeframe for more sensitive conversations.

Be aware that discussions around political or strategic topics may be monitored by far-right actors, especially in groups or channels used for mass communication/mobilization where you don't fully control who joins.

Avoid saying anything on WhatsApp that you wouldn't publish openly on social media.

If you're planning sensitive actions among trusted folks, use Signal.

For activists, Meta AI is a data collection feature dressed up as a helpful assistant. Anything you ask it about your organizing, your contacts, your locations, or your plans gets stored, profiled, and potentially exposed to law enforcement.

Tagging @MetaAI in a group chat pulls the surrounding messages into Meta's systems, even if you only meant to ask a quick question. Once Meta AI is in the conversation, that history is no longer just between the people in the chat.

To keep Meta AI out of specific chats and groups, also turn on Restricted chat on those chats.

What is "Linked Devices"? WhatsApp lets you use your account on other devices (a computer, a tablet, a second phone) by linking them through a QR code or pairing code. Most people never use this feature. See WhatsApp's official explainer if you want more background.

Attackers have figured out that they can trick you into linking their device to your account. If a website or stranger walks you through "verifying" by entering a code in WhatsApp, that's not verification. That's you giving them full access to your chats. The same trick works with QR codes.

So: never enter a pairing code or scan a WhatsApp QR code because a website or person asked you to. Only scan a WhatsApp QR code when you yourself just opened WhatsApp Web or Desktop.

You can audit your account at any time. See Check Linked Devices regularly.

Your WhatsApp PIN and the 6-digit verification code WhatsApp texts you are the keys to your account. Anyone who gets them can take it over.

Never share these codes with anyone, for any reason. This applies even if the person says they're from "WhatsApp Support" or "WhatsApp Security". WhatsApp will never DM you, call you, or text you asking for your PIN or verification code. If someone asks, it's a phishingPhishingA scam that tricks you into giving up your password and two-factor authentication code. It often looks like a real message from someone you trust, like a fake email from Google or a fake message from "Signal Support."Learn more: EFF Surveillance Self-Defense attempt.

There has been an increase in fake messages claiming to be from "WhatsApp Support" that try to hijack your account this way. If you're not sure whether a message is legit, don't reply, don't tap any links, and don't enter any codes. Instead, contact WhatsApp through the in-app Help section.

Restricted chat is a per-chat setting. When it's on, nobody in that chat can:

• Export the chat
• Have photos and videos from the chat automatically saved to their camera roll
• Use Meta AI features in the chat
• Open the chat on a linked device, like WhatsApp Web, WhatsApp Desktop, or a tablet

This is meant to keep AI agents and unofficial WhatsApp apps out of your chats. These tools connect to someone's WhatsApp account as a linked device. If anyone in your group has connected one, it can read every chat on their account, including your group's. Turning on Restricted chat blocks them from reading that chat. It also helps if an attacker tricks someone in the chat into linking the attacker's device to their account (see Check WhatsApp's Linked Devices list regularly).

You must turn it on for each sensitive chat. It can't be set automatically across all chats, and you can only change it from your main phone.

Photos and videos you receive on WhatsApp can end up in more places than you think. By default, WhatsApp may save them straight to your camera roll, and iCloud or Google Photos will then back those up to the cloud automatically.

That means sensitive images (protest footage, photos of organizers, anything that could expose your community) and their metadata (such as the location and time the photo was taken) can sit in a Google or Apple account where law enforcement can subpoena them. Deleting every copy later becomes much harder.

A lot of community organizing happens in unvetted groups on WhatsApp where you don't know how much you can trust everyone in the group. These groups can be infiltrated by right-wing adversaries and law enforcement.

Using a fake name or just your first name prevents someone from finding your real identity through a Google search. Using a photo that isn't your face prevents someone from finding your social profiles based on image search or facial recognition. Both steps help defend you against doxxing and online harassment.

Remind people in your groups to do this as well. Security is a team sport.

WhatsApp now lets you pick a username. Once your username is active, people who don't already have your phone number saved see your username instead of your number. You can also give someone your username instead of your phone number when you want to connect with them.

This matters most in large or unvetted organizing groups, which can be infiltrated by bad actors. Your phone number is one of the easiest ways for someone to find out who you are.

WhatsApp is turning usernames on country by country. If usernames aren't active where you live yet, you can still reserve one now so it's ready when they are.

WhatsApp lets you share your real-time location with a person or group for a set amount of time. It's easy to turn on and forget about, especially if you started sharing with someone hours ago.

For activists, an open live-location share is a direct map of your movements that anyone in the chat can see.

The safest option is to leave backups off entirely (see Disable WhatsApp chat backups). Only enable backups if you actually need them, for example if you're transferring devices or crossing a border and need to temporarily delete WhatsApp.

If you do need backups, turn on WhatsApp's built-in end-to-end encrypted backup. Without this, Google or Apple can be compelled to hand your entire chat history over to law enforcement.

If you're running an organizing group, the settings on the group itself matter as much as your personal settings.

Group chat privacy is only as strong as the least secure member. If one person is an infiltrator or has a compromised device, everything in the chat can be exposed. Support your group to follow norms together.

WhatsApp has a newer feature called Communities that lets you create a parent group containing multiple subgroups.

The benefit for organizers is that Communities have a "phone number privacy" feature so that other members can't see each other's phone numbers.

If you're running a large organizing group on WhatsApp, consider migrating to a Community to reduce the risk of members being doxxed by other members or infiltrators.

Spyware is an advanced type of attack, exploiting sophisticated vulnerabilities on our devices. In response, Apple and Google have introduced an advanced security mode that offers enhanced protection against spyware.

On iPhones, it's called Lockdown Mode and on Android, it's called Advanced Protection Program. (You can also enable Advanced Protection Program on just your Google Account even if you don't have an Android phone.)

We have no reports of anyone getting infected with spyware who had Apple's Lockdown Mode enabled. Android's Advanced Protection is more recent and its effectiveness has yet to be tested.

Every time a new operating system update comes out, it is fixing security holes. Each update you haven't installed represents a longer list of ways the cops can hack into your device. Think of it as a big building with more and more doors left unlocked.

If your operating system is not up-to-date, many of the other recommendations in this guide will not protect your data.

Start with your phone. If you're doing something higher risk, make sure to update all your devices.

Caveat: Face and fingerprint unlock let you use stronger passwords without typing them all the time. If you have to choose, it's better to have a longer passcode than to turn off face/fingerprint unlock. If you leave biometrics on, make sure you know how to quickly turn them off if you're heading into a high-risk situation (see tips below).

How long does it take to crack a passcode?

Note: These times only apply to phones. Computers can be cracked much more quickly, and need much stronger passwords.

Sources: The estimates in the table above assume real-world observed attempts/second from police forensic hacking tools. If you need more security, use a 10-digit passcode, which will protect you even under the highest-possible cracking scenarios. See the sources linked in the passcode FAQ here.

Meta recently rolled out a feature in the Facebook app where all images in your photo library are sent to their servers and processed. This is a significant violation of privacy and could present legal risk to activists.

Meta (the parent company that also owns WhatsApp) has claimed that this kind of feature doesn't exist for WhatsApp. Even so, it's worth disabling broad photo access for WhatsApp, since the company rolled out the exact feature on Facebook.

If your phone is confiscated, your notification history can reveal message content and sender names, even after the messages themselves have disappeared. See the Prairieland case for why this matters.

Apple has fixed the issue that lead to incoming Signal notifications being stored even after messages were disabled in iOS/iPadOS 26.4.2 (and the older 18.7.8 maintenance branch). Even though they fixed that issue, it's unclear whether Android phones still present the same weakness, so it's worth hiding previews on either platform.

Apple Intelligence and Android's notification summaries can send parts of your notifications to cloud servers. It's not fully clear what gets sent where, and the data could be compelled by a government request.

We have an article about this topic as it relates to Signal. The same reasoning applies to WhatsApp: Is Apple Intelligence reading my Signal messages?

WhatsApp's multi-device feature is a major pathway for an attacker to takeover your account. Attackers trick you into scanning a QR code or entering a pairing code, and their computer can start seeing all the messages you send and receive.

The same multi-device infrastructure has also been used by mercenary spyware to target journalists and organizers. See our spyware page for more.

For your most sensitive chats and groups, turning on Restricted chat keeps those chats off linked devices entirely, so a hijacked linked device can't read them.