The Facebook-owned messaging app began testing the security feature last November
WhatsApp began beta-testing two-step verification last November, and the Facebook-owned messaging application has quietly made the security feature available to all users.
Two-step verification enables WhatsApp users to create six-digit passcodes to verify their phone numbers on WhatsApp, and users can also opt to use recovery email addresses.
To enable two-step verification, open WhatsApp, Settings, Account, Two-step verification, Enable.
Upon enabling this feature, you can also optionally enter your email address. This email address will allow WhatsApp to send you a link via email to disable two-step verification in case you ever forget your six-digit passcode, and also to help safeguard your account. We do not verify this email address to confirm its accuracy. We highly recommend you provide an accurate email address so that you’re not locked out of your account if you forget your passcode.
Important: If you receive an email to disable two-step verification, but did not request this, do not click on the link. Someone could be attempting to verify your phone number on WhatsApp.
If you have two-step verification enabled, your number will not be permitted to reverify on WhatsApp within seven days of last using WhatsApp without your passcode. Thus, if you forget your own passcode but did not provide an email to disable two-step verification, even you will not be permitted to reverify on WhatsApp within seven days of last using WhatsApp. After these seven days, your number will be permitted to reverify on WhatsApp without your passcode, but you will lose all pending messages upon reverifying—they will be deleted. If your number is reverified on WhatsApp after 30 days of last using WhatsApp and without your passcode, your account will be deleted and a new one will be created upon successfully reverifying.
To help you remember your passcode, WhatsApp will periodically ask you to enter your passcode. There is no option to disable this without disabling the two-step verification feature.