Is WhatsApp Web safe?

What protects you by design

• End-to-end encryption on every device. A linked computer gets its own identity key. The sender's app encrypts each message separately for every device you own, so it is readable only on your devices and the recipient's.
• Linking needs your phone. Nobody can add a computer to your account without your unlocked phone in hand, or without you scanning their code or typing their linking code.
• Your screen lock guards the link. If the phone has a fingerprint, face or PIN lock, WhatsApp asks for it before it links anything.
• Warnings for suspicious requests. Since 2026 WhatsApp shows an alert when a linking request looks like a scam, including where the request is coming from, before the device is linked.
• You see every session. Linked devices lists each linked device and when it was last used, and logs any of them out in one tap.

The real risks, in order

1. Being talked into linking someone else's computer

The most common takeover works without any hacking. A page or message, often from a contact whose account was already taken over, asks you to "vote", "see your photo" or "verify your account". It shows a QR code to scan, or asks for your phone number and then tells you to type an eight-character code into WhatsApp. Both are real WhatsApp linking requests, started from the attacker's browser. Once you complete one, their computer is a linked device on your account: it reads your recent chats and can send messages as you.

Meta warned about this pattern in March 2026, and security researchers at Gen Digital documented the phone-number variant under the name GhostPairing.

2. A computer left logged in

Closing the tab does not log out. On a shared, borrowed or office computer, anyone who opens web.whatsapp.com in the same browser profile is in your chats. Log out from Settings, or remotely from your phone.

3. Look-alike websites, unofficial apps and extensions

WhatsApp's advice is to link only to its own apps and web.whatsapp.com, and it says that linking your account to an unofficial app or website can lead to a temporary or permanent ban. Modified apps such as GB WhatsApp fall under the same rule. Browser extensions that promise extra WhatsApp Web features can see everything in the tab.

4. Someone with access to your unlocked phone

Thirty seconds alone with your unlocked phone is enough to link a computer. A screen lock on the phone closes this door, because WhatsApp asks for it before linking.

Settings worth switching on

1. Screen lock on the phone (fingerprint, face or PIN). It is what protects the link-a-device screen.

2. Two-step verification on the phone: Settings, Account, Two-step verification. It stops someone registering your number elsewhere. Since August 2026 it is a password of at least eight characters with a letter and a number, no longer a six-digit PIN.

3. App lock on WhatsApp Web: open Settings, then Privacy, then App lock, and set a password of 6 to 128 characters. Choose automatic locking after 1 minute, 15 minutes, 1 hour or 8 hours, or lock at once with Ctrl + Alt + L (Cmd + Ctrl + L on a Mac). Notifications are hidden while it is locked. App lock exists on WhatsApp Web and in the Windows app, not yet in the Mac app.

4. Phone notifications for WhatsApp. WhatsApp notifies the phone when a new device is linked; if you did not do it, tap the notification and remove the device.

5. Review linked devices once a month and after any lost or lent phone.

6. Code Verify, Meta's open-source extension for Chrome, Firefox and Edge, confirms that the WhatsApp Web code in your browser has not been altered. A green tick means validated. It applies to the browser only, not to the desktop apps.

7. Security notifications: in WhatsApp Web open Settings, Account, Security notifications and turn on Show security notifications on this computer. You are then told when a contact's security code changes, for example when they add a device. It is set per device.

How to spot a fake WhatsApp Web

• The address is anything other than web.whatsapp.com. Read it letter by letter; look-alikes swap or add characters.
• It arrived through an ad, an email or a message rather than you typing the address or using your own bookmark.
• It asks for your phone number and then for the six-digit registration code that arrives by SMS. WhatsApp Web never asks for that code.
• It wants a download, a browser extension or a "security update" before showing your chats.

On a work computer

End-to-end encryption protects messages in transit, not what is on the screen. An employer's monitoring software can capture what any window shows, WhatsApp Web included, and downloaded files land on a disk you do not control. For customer conversations a company should run an account it manages: see WhatsApp for business.