One of the biggest changes to WhatsApp's architecture in years is now on the way. The company plans to let users choose their own usernames, a feature that is not yet fully active, though username reservation has already begun. The full rollout is planned for the second half of the year. With this move, WhatsApp is aiming to close a privacy gap that has drawn criticism for a long time.
Previously, anyone who obtained a phone number could attempt to contact its owner on WhatsApp. Making contact with someone, for instance through a group, meant automatically gaining access to their number. Going forward, contact will be possible solely through a username, with no phone number revealed. Until now, the phone number has functioned simultaneously as login credential, contact address and identity anchor on WhatsApp. Its advantage lies in the stability it offers for identity verification. Because phone numbers are not easily changed, they feel familiar to users. Anyone who has saved a known contact's number can be confident about who they are writing to.
A Massive Privacy Gap
That same stability, however, comes at a cost: a genuine privacy gap. Because a phone number is such a personal identifier, it ties together WhatsApp, phone calls, SMS, banking, contact with authorities, two-factor authentication for various apps and personal address books, particularly on smartphones. This linkage has long been a source of criticism for WhatsApp. Anyone who ended up in a group or community has, until now, automatically revealed their phone number in the process.
Going forward, a freely chosen username is meant to separate these layers, serving as the public contact address while keeping identification unambiguous, all without exposing the phone number. This is where the benefit lies, although it comes with new risks of its own. Starting with the advantages, the most significant is data minimization. Users can message someone without giving out their phone number, a feature useful for groups, events, classified ads, initial professional contacts, clubs, parent chats, or political and journalistic contacts.
A New Layer of Contact Security
There is a further benefit: usernames make it harder to harvest phone numbers en masse. A 2025 study demonstrated that WhatsApp's reliance on phone numbers had effectively allowed large-scale harvesting of them, with researchers able to check vast quantities of numbers to determine which were active on the platform. Given how valuable phone numbers are as data, and how prone they are to misuse, this represents a meaningful fix.
WhatsApp now plans to introduce additional safeguards to secure contacts through its new usernames. Public username search will not be possible, meaning users must know the exact username to make contact. The names of celebrities, government bodies and other high-profile identities are meant to be withheld. An optional username key is also planned: a further code that others must know in order to reliably verify a contact.
The username key is the most interesting innovation from a security standpoint, rendering the username alone worthless as proof of identity. Someone who wants to be publicly reachable as, say, john.smith can require a key before a contact can be verified. Users should activate the username key as soon as it becomes available, since it represents a genuine gain for security.
The Impersonation Problem
The main drawback is that usernames are much easier to imitate than phone numbers. A phone number is unambiguous, and once a contact is saved in the address book, there is no risk of confusing it with another. Usernames, however, tend to follow predictable patterns familiar from other platforms, such as name, name_official, name123, real_name, name_support and name_team, variations that are easily mistaken for one another. This is the exact concern raised by Ankur Warikoo, who fears that many users will skip past verification notices and fall for lookalike usernames, particularly where public figures are involved or fraud rates are high. A further drawback is cross-platform recognizability: anyone using an identical name on WhatsApp, Instagram, X, Telegram, YouTube or professional profiles makes it easier for others to connect the dots between accounts, something users should weigh carefully before opting in.
The biggest risk, however, is identity forgery. Fraudsters can attempt to impersonate celebrities, companies, authorities, banks, clergy, employers or relatives simply by using similar-looking names. A related risk is social engineering, commonly known as the grandparent scam, a form of fraud that operates not on a technical level but a psychological one. Where the old line was "It's me, I have a new number", it now becomes "This is now my official WhatsApp username". Users may infer trust from a name alone, even though a name proves nothing on its own.
Danger of Name-Grabbing
There is also the risk of name squatting. Anyone who fails to reserve their name, brand name or well-known online handle early on may later be confronted with variants, copycats or confusion. WhatsApp intends to protect well-known names, but for less prominent individuals, small businesses, local initiatives or journalists, this is likely to prove more difficult. A further risk is a false sense of security, since users might assume that if no phone number is visible, they are automatically safe. That is not the case.
While end-to-end encryption secures the content of communications, it offers no protection against fake contacts, fraud, metadata harvesting, screenshots or the voluntary disclosure of sensitive information, meaning vigilance will remain essential. A further concern is the potential for a new kind of spam based on guessable usernames. WhatsApp counters that usernames cannot be searched publicly and that warnings are shown for first-time contacts.
On balance, WhatsApp's new system represents progress for privacy, but only if users take advantage of all its security features, particularly the Username Key. Ultimately, though, no security system can compensate for the careless handling of confidential information.