# WhatsApp Finally Launches Usernames to Shield Phone Numbers From Strangers


Meta's messaging giant is rolling out a long-awaited privacy feature that lets users replace their phone numbers with custom usernames—a move that mirrors competing services and addresses a decade-old vulnerability in the platform's contact discovery system.


## The Threat


WhatsApp's 3+ billion users will soon have the ability to hide their phone numbers from unsolicited contact. Starting this week, users can reserve custom usernames, with full rollout expected across all countries over the coming months. Once active, people who don't have a user's phone number in their contact list will see the username instead of the number—a seemingly simple change with significant privacy implications.


The feature includes an optional username key: an additional credential that contacts must know before they can message a user via their username. This two-layer approach gives users granular control over who can reach them through the new identity mechanism.


"Usernames are our latest step to make WhatsApp even more private," Meta said in its Monday announcement. "There's no directory to browse and no suggestions—people will need to know your exact username to contact you for the first time."


## Background and Context


For years, security researchers and privacy advocates have flagged WhatsApp's phone number-based contact discovery as a weak point. Unlike encrypted messaging services that use randomized handles or identifiers, WhatsApp's system ties every account directly to a phone number—an identifier that's increasingly easy to find, enumerate, and target through data breaches, SIM swapping, and bulk phone number scraping.


The timing of WhatsApp's rollout is notable: Signal launched username support in February 2024, after a public testing period in late 2023. Telegram, which prioritizes anonymity, has allowed usernames from its inception. WhatsApp's delayed entry into this space highlights Meta's historically slower approach to privacy-forward features, despite acquiring the company specifically for its end-to-end encryption in 2014.


Meta's announcement also appears to acknowledge a core problem with at-scale username systems: name collisions. With 3 billion users, generic usernames like "alice" or "john" are claimed within seconds. To solve this, Meta is opening username reservations early—before full feature rollout—to give users time to secure their preferred handles.


The company is also reserving certain usernames for governments, public figures, and businesses, a protective measure aimed at preventing impersonation and squatting.


## Technical Details


### How Username Reservations Work


Users can reserve a username now by navigating to Settings > Account > Username in the latest WhatsApp build. Once the feature launches in their country, the reserved username becomes active, and the user's profile will display the username rather than the phone number to contacts outside their saved list.


### The Username Key: An Optional Second Factor


The optional username key is WhatsApp's answer to a real problem: even with usernames, if an attacker knows your exact username, they can message you. The username key adds friction—the attacker must also know an additional passphrase or code to initiate contact.


This is *not* a password in the traditional sense; it's a shared secret that a user can distribute to trusted contacts. If someone tries to message you via username without knowing the key, their message is rejected.


### Directory-Less Design


Unlike traditional messaging apps with searchable user directories, WhatsApp's username system is discovery-resistant by design. There is no user directory to browse, no autocomplete suggestions, and no "find people" feature. This is a significant departure from platforms like Telegram, where users can search public usernames.


This architecture minimizes the risk of mass enumeration attacks—a technique where attackers systematically test thousands of usernames to identify active accounts.


### Username Flexibility


Users can change or delete their reserved username at any time, though doing so allows others to claim the deleted handle. This prevents permanent squatting while giving users the flexibility to maintain privacy by rotating their username.


## Implications for Users and Organizations


### Who Benefits Most


Activists and journalists operating in restrictive environments will benefit significantly. Hiding a phone number reduces the attack surface for SIM swapping, phone number harvesting, and targeted surveillance based on known contact lists.


Victims of harassment can reserve a username and disable phone number visibility to strangers, though existing contacts will still see their phone number.


Organizations deploying WhatsApp for business can now use usernames as a layer of operational security, reducing the exposure of corporate phone numbers to customers who may later become targets of social engineering.


### Risks and Limitations


Usernames are not encrypted. While your phone number becomes hidden from strangers, your username is still visible to anyone you message. Meta does not hash or encrypt usernames server-side, meaning WhatsApp employees and law enforcement with court orders can still access your username and associate it with your account.


The feature is opt-in. Users who don't reserve a username before rollout may find their preferred handles claimed by others. This creates a two-tier privacy system: those who proactively reserved usernames have better privacy, while passive users see no change.


Usernames can still be enumerated if leaked. If your username appears in a data breach or is shared publicly online, attackers can target it directly. The username key offers some mitigation, but only if you've enabled it.


### The Broader Privacy Trend


WhatsApp's move reflects an industry-wide shift toward reducing phone number exposure. As telecommunications infrastructure becomes a common attack vector—SIM swapping, SS7 interception, number porting fraud—major platforms are deprioritizing phone numbers as the primary identity mechanism.


## Recommendations


### For Individual Users


  • Reserve your username now. Go to Settings > Account > Username on the latest WhatsApp version. Don't wait for rollout in your country—secure your preferred handle early.
  • Enable the username key if you want additional privacy. Share it only with trusted contacts.
  • Update your privacy settings to hide your online status, read receipts, and last seen timestamp—username privacy is just one layer.
  • Disable "Add Me by Phone Number" in your privacy settings to prevent strangers from initiating contact via phone number lookup.

    • ### For Organizations


  • Deploy usernames in official business accounts to reduce the exposure of customer-facing phone numbers.
  • Audit your WhatsApp contact lists to identify which numbers are known to external parties and could be targeted for SIM swaps or spoofing.
  • Educate staff on the difference between usernames and phone numbers. A username shared in a public directory is still sensitive information.

    • ### For Defenders and Security Teams


  • Monitor for username harvesting campaigns. As the feature rolls out, watch for coordinated efforts to reserve high-value usernames (CEO names, brand names, government agencies).
  • Track phishing attempts using usernames. Attackers may impersonate organizations or officials via username to bypass phone number–based defenses.

    • ## HackWire Analysis


    WhatsApp's username feature is a privacy improvement, but it's a decade late and it's incomplete. The company had opportunities to reduce phone number dependence years ago. Instead, it chose to double down on phone-number-based contact discovery—a decision that left billions of users vulnerable to SIM swapping, number harvesting, and targeted phishing. Now, facing competitive pressure from Signal and broader industry scrutiny of phone-number-based identity, Meta is playing catch-up.


    The bigger story is what usernames *don't* solve. Your phone number is still linked to your WhatsApp account on Meta's servers. It's still the recovery mechanism for your encryption keys. It's still visible to any contact in your phone who also uses WhatsApp. And critically, usernames don't protect against the most common WhatsApp attack vector: the compromised contact who shares your number with a threat actor, who then social-engineers your way into your account via fake login attempts.


    The username key is a minor brightspot—it adds friction, which matters—but it requires users to proactively enable it, and most won't. This is consistent with Meta's broader pattern: privacy is positioned as an opt-in luxury, not a default baseline.


    What *is* significant is the network effect. When 3 billion people have the option to hide their phone numbers, the threat landscape shifts. Bulk phone number databases become less valuable for targeting. SIM swapping campaigns that rely on knowing a victim's number in advance face friction. Organizations that depend on phone number enumeration for lead generation or research have a new obstacle to work around.


    The real test will be adoption. Will users actually use this feature, or will usernames become another abandoned privacy control that sits unused in the Settings menu? Signal's username adoption has been modest—most users still rely on direct contact import or phone-based discovery. WhatsApp will likely follow the same pattern. But even modest adoption moves the needle on privacy for the most targeted users: dissidents, journalists, and security professionals who take the time to set it up.


    — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)