WhatsApp tool guide: sign-in, groups, calls and backups

WhatsApp encrypts personal messages and calls end to end, but the account is tied to a phone number and a cloud backup is encrypted only if you turn that setting on. Enable two-step verification, review linked devices, and use a username if it is available to you so new contacts do not see your number. End-to-end encryption protects the text on the path; it does not stop a screenshot, an unlocked phone or an unencrypted backup.

A comparison with Signal is in Signal and WhatsApp. If the first decision is which channel to use, start with choosing private channels. Install WhatsApp only from whatsapp.com or the official store, not from a Plus build or a file shared in a group.

Sign-in is tied to the number

You need an active number to create an account. Someone who receives SMS on that number can register the account again and kick you off your device if two-step verification is off. Never send the six-digit registration code to anyone; WhatsApp will not ask for a code inside a chat.

1. Install the app from the official path and enter your own number.
2. Type the registration code only on the official screen of the app.
3. If you have a dual SIM, check that the code arrives on the number you want the account to use.
4. Do not use a work number or a number you will lose tomorrow for a sensitive account.

Two-step verification

1. Go to Settings > Account > Two-step verification.
2. Turn it on. Newer versions may ask for a password instead of a six-digit PIN; if you still have a PIN, look on that same screen for the official upgrade to a password.
3. Add a recovery email so you have an official path if you forget the PIN or password. Protect that inbox with a unique password and a second factor as well.
4. Keep the PIN or password in a password manager or on separate paper, not in a WhatsApp chat.
5. This verification is not a chat backup and will not bring history back; it only stops someone from registering the number again without that secret.
6. Do not send a registration SMS code, the PIN or a backup key to anyone who claims to be support.

A username if it is available to you

A username is an optional way for a new contact not to see your number. You still need a number to register, and someone who already has the number in their address book can usually find you.

1. If the option is there, create a username from the profile or account settings. Choose something that is not easy to guess.
2. If your version has a username key, turn it on so a first contact needs both the username and the key. You can change the key later to close old paths.
3. Do not put the username in a public group or a broadcast channel unless you must.
4. When someone writes for the first time, read the context card: country, groups in common and the fact that they are a new contact.

Linked devices

You can link a computer, tablet, the web or some companion phones to the account. Communication on a linked device is end to end as well, but each extra device is another way in. The limit is usually four linked devices at once, and the primary phone needs to stay active.

1. Open Desktop and Web from whatsapp.com or web.whatsapp.com, not from a short link in a message.
2. On the phone go to Settings > Linked devices and link the new device.
3. Scan the QR code only from the page you yourself opened. A code that arrives in a chat saying “scan this to verify” can create an attacker’s session.
4. Read the list and disconnect anything unknown. If the doubt is serious, disconnect them all and link again only what is yours.
5. After you finish on a shared computer, unlink it from the list and sign out on that computer itself.
6. A second phone linked as a companion device has the same sensitivity; disconnect it when you no longer need it.

Security notifications and comparing the encryption code

1. In Account settings, turn on Security notifications so a change in a contact’s security code is reported to you.
2. To compare, open the chat, tap the contact’s name and open Encryption.
3. Match the code in person or on a call where you already know the other person, or scan the QR code.
4. If the app says the code changed, ask why through another channel. A new device on their side creates this notice; if they did not get a new device, wait before you send sensitive material.

Walk through Privacy checkup once

1. Go to Settings > Privacy and open Privacy checkup.
2. Finish each section: who can see profile information, app lock, the default message timer and end-to-end encrypted backup.
3. The shortcut does not replace your decisions, but it helps you avoid skipping a step.
4. Repeat the checkup after your circle of contacts changes or after you travel.

Last seen, profile photo and being added to groups

1. In Privacy, limit Last seen and online. If you hide last seen from others, you usually cannot see theirs either.
2. Limit Profile photo, About and Status to contacts or to nobody if strangers should not see them.
3. Choose who can add you to groups. For sensitive work set this to contacts or tighter.
4. Turn off read receipts if you need to; in that case you also will not see other people’s receipts in a one-to-one chat. Receipts in groups behave differently.
5. Share live location only when it is needed at that moment, then turn it off.

App lock and chat lock

1. In Privacy, turn on App lock so the app asks again for a fingerprint, face or the device code. Set a short auto-lock time.
2. For more sensitive chats, turn on Chat lock from the chat itself or by holding the chat. A locked chat moves to a separate folder and closes when you lock the device.
3. If there is a secret code that hides the folder, write it down outside the app. It keeps that chat out of the main list, but a copy remains with the other person.
4. Chat lock does not notify the other person and does not replace end-to-end encryption.

Disappearing messages and view-once

1. Set the default timer for new chats in Settings > Privacy > Default message timer to 24 hours, 7 days or 90 days if you want less history to remain.
2. For one chat, open the chat info and then Disappearing messages.
3. In a group, an admin can limit who is allowed to change this setting.
4. A kept message no longer follows that timer and stays visible to everyone in that chat.
5. Forwarding to a chat without a timer makes the message last there.
6. View-once does not stop a screenshot or recording with a second device on every operating system.
7. If a backup was made before a message disappeared, that message may be inside the backup and then be removed after a restore according to the app’s rules; do not treat that as certain deletion everywhere.

Advanced settings: network address and link previews

1. In Privacy, open Advanced.
2. Turn on Protect IP address in calls so the call goes through the service and the other party does not see your network address so easily. Call quality may drop a little.
3. If Disable link previews is there, turn it on for sensitive work so building a preview does not reveal a network address.
4. If Block unknown messages is there, look at it as a way to reduce spam from strangers.
5. Silence calls from unknown numbers in the Privacy calls section if that option exists.

Encrypt a cloud backup separately

End-to-end encryption of a chat does not automatically encrypt the cloud copy. Google or Apple can technically hold an ordinary backup on a Google account or iCloud. Until you turn on end-to-end encrypted backup, history in the cloud does not have the same protection as the chat itself.

1. Go to Settings > Chats > Chat backup.
2. Open End-to-end encrypted backup.
3. Choose a passkey, a password or a 64-digit key. WhatsApp cannot recover this; losing it means that backup will not open again.
4. Keep the key or password in a password manager and on a separate paper copy, not inside WhatsApp itself.
5. On iPhone, after you turn this on, also remove WhatsApp from the iCloud device backup: system Settings, your name, iCloud, iCloud Backup, the device, and toggle WhatsApp off. A full-device backup usually does not use WhatsApp’s end-to-end backup encryption.
6. On Android, if you have both a Google account backup and WhatsApp cloud storage, see which one is on. Official WhatsApp cloud storage, when available, is described as end-to-end from the start; do not treat a Google account backup as safe without that separate setting.
7. If you do not want history in the cloud, turn automatic backup off and use the official on-device chat transfer when you change phones.
8. The broader framework for a copy you can restore is in backups you can restore.

Groups, communities and channels

1. Before you create a sensitive group, decide who can add members, edit info and send messages.
2. Turn on approval of new members if the group should stay limited.
3. Give an invite link an expiry, or revoke it after the members you wanted have joined.
4. Treat the group name and picture as information that every member, and sometimes invitees, can see.
5. A new member may see part of the history; do not write highly sensitive material in a large group.
6. Do not treat a Community as a one-to-one chat.
7. A Channel is a public space, not a personal end-to-end chat. Treat following a channel and reacting there as publishing.

Media, the gallery and notifications

1. In Storage and data, limit automatic media download, especially on mobile data.
2. Turn off saving to the camera roll or gallery for sensitive chats.
3. Turn off notification text previews on the lock screen.
4. A locked chat usually hides notification text; still keep the phone’s screen lock on.

Do not confuse a business chat with a personal chat

A personal one-to-one message is end to end. A conversation with some businesses that use cloud business tools may be readable by that business or its support staff. Do not treat shop support, an ad or a business account as a confidential channel.

1. If you have an official WhatsApp Business account separate from a personal one, do not mix it onto the same sensitive number unless you must.
2. Do not confuse an unofficial “Business Plus” build with the official WhatsApp Business app.

Changing the number, a lost phone and the SIM

1. Change the number from Settings > Account > Change number while you still control the old number.
2. If the phone is lost, review sessions from a linked device if you have one, suspend the number with the operator as soon as you can, and sign in on a new device with two-step verification.
3. After the new sign-in, disconnect unknown linked devices and change the verification PIN or password if it may have leaked.
4. A recycled number may still have two-step verification from the previous owner; in that case signing in may be delayed for a few days. That delay is part of the protection.

Official installs, proxies and modified builds

1. Android: the official store or the path listed at whatsapp.com.
2. iPhone: the Apple store.
3. Do not install builds named Plus, GB or cracked versions; they often read the session and files.
4. If you need a proxy, open Storage and data and then Proxy. Do not enter an unknown proxy that is passed around in groups without review; its operator can see when you connect. A proxy is not chat encryption.
5. Update through the same official path.

What WhatsApp does not hide

The service can see which number is in contact with which number and when, which groups you belong to and which network address you signed in from. End-to-end encryption hides the text and sound of a personal chat more thoroughly from the service, but it does not erase the existence of the account or this metadata. If the goal is to hide your identity from the service itself, this app is not the right tool. Dependence on a number also means that control of the SIM and of SMS is part of the account’s security, not something separate from the in-app settings. If you lose the number and do not have two-step verification, that SMS alone can open the account for someone else. Treat control of that same number and of SMS as part of your security plan, not as just one small setting inside the app itself.

For more confidential work, practical Signal steps are in using Signal safely.

If you think the account is at risk

1. If you are still signed in, change the two-step verification PIN or password and disconnect every unknown linked device.
2. Register again from your own device so a session on a stolen phone is closed, then review the linked list again.
3. Tell people who need to know not to take seriously a new message from that number asking for a code or for money.
4. The rest is in recovering a compromised account.

Common mistakes

• Leaving two-step verification off and relying on SMS alone.
• Backing up to Google or iCloud without end-to-end encrypted backup.
• Scanning a login QR code from inside a message.
• Installing WhatsApp Plus from a channel.
• Writing sensitive material in a broadcast channel or a very large group.
• Assuming disappearing messages stop a screenshot.
• Leaving WhatsApp Web open on a shared computer.
• Sending a registration code to “support”.

Status and broadcast lists

1. In Privacy, open Status and choose who can see it: contacts, contacts except some people, or only some people.
2. Do not treat Status like a public story on another network, but a screenshot is still possible.
3. A broadcast list only reaches people who have saved your number; do not treat it as a confidential group, because each recipient sees the message as a one-to-one chat and can forward it.

Exporting a chat

1. If you need a local archive, use the export path from the chat info only for that conversation.
2. The export file no longer sits behind WhatsApp’s lock; keep it like any sensitive document.
3. Do not leave the export on a shared computer or in a public sync folder, and delete the temporary copy after you move it.
4. An export without media is usually smaller; include media only if you need it.

Synced contacts and suggestions

1. WhatsApp looks at the address book to find people you know. In the system settings, see whether it has access to all contacts.
2. If identities should stay separate, do not mix a work address book on the same phone with a personal account.
3. Limit automatically inviting contacts to WhatsApp if that option is there.

Blocking, reporting and fake support messages

1. From a contact’s info you can block and report. Blocking does not erase a copy already on their device.
2. Ignore a message that says your account will be removed and asks you to tap a link or send a code; open only the official app.
3. If someone with a familiar name and a new number asks for a login code or for money, check through another channel.
4. Ignore a fake verification badge or an offer of “WhatsApp Plus with more views”.

Calls, call links and group calls

1. Do not put a call link in a public channel if the session should stay limited.
2. Do not put a group call on speaker in a public place.
3. Even with IP address protection, the other party hears your voice and can record it.

Review shared media

1. In each important chat, open the media, links and files section and see what is still there.
2. Delete a file that should no longer stay on the device; a copy may remain with others.
3. Look at starred messages once as well; a star can keep something out of disappearing in some cases, or at least keep it in a separate list.

If you forget two-step verification

1. If you added a recovery email, use that official email path.
2. If not, the app may make you wait several days before it removes verification from the number. Registering again on a new device is hard during that wait; plan for this before you change phones.
3. After you recover access, turn verification back on immediately and add an email.

Several accounts on one phone

Some Android versions let you keep two WhatsApp accounts on one device. That makes switching easy, but the same phone, the same system backup and the same screen lock hold both accounts in one place. If identities should stay separate, two accounts on one phone are not separation by themselves.

1. Create the second account with a number you control and give it its own two-step verification.
2. Do not send a sensitive chat from the wrong account; check which account is active before you send.
3. Review each account’s linked devices separately.

Request account info

1. In Account settings, if Request account info is there, you can ask for a report of account settings and metadata.
2. That report is not the text of end-to-end chats; do not confuse it with exporting one conversation.
3. Keep the file like a sensitive document and delete it after you read it if you do not need it.

Deleting the account

1. You delete the account from Settings > Account > Delete my account. Groups where you are the only admin are then left without an admin; appoint another admin first.
2. Deletion does not erase copies other people already saved or forwarded.
3. If you only want to sign out of this device, you do not need to delete the account; just unlink that device.

What to do today

1. Finish two-step verification and the recovery email, and store the secret outside the app.
2. Read linked devices and disconnect anything unknown or any shared computer.
3. Complete Privacy checkup, limit who can add you to groups and set last seen to match what you need.
4. Turn on app lock and lock sensitive chats.
5. Turn on end-to-end encrypted backup, or turn cloud backup off on purpose. On iPhone, also remove WhatsApp from the iCloud device backup.
6. Turn on IP address protection in calls and, if you need it, disable link previews.
7. Reduce automatic downloads and saving to the gallery for work chats.
8. If a username is available, set it with its key and do not broadcast it in public.
9. Turn on security notifications and compare the encryption code with one important contact.
10. Remove unofficial builds, turn off notification previews and review one work chat for leftover media.