WhatsApp has officially begun global rollout of optional usernames, allowing its more than 3 billion users to receive messages and calls without ever sharing their phone number. Username reservations opened on June 29, 2026, with the feature rolling out across the app over the coming months.
The move closes a long-standing privacy gap: until now, anyone with your phone number could message you on WhatsApp, enabling targeted harassment, spam campaigns, and social engineering attacks that started with a number harvested from a data breach or public source.
How It Works
The feature is entirely optional. Users who choose to set a username can be contacted through it instead of their phone number, with several privacy-preserving design choices:
- No public directory — there is no searchable index of usernames. Someone must know your exact username to initiate contact
- Phone number stays hidden from new contacts who reach you via username
- Optional passphrase protection — users can require a key or passphrase before someone can message them via username, adding another layer of friction against unsolicited contact
- Existing contacts who already have your phone number retain visibility of it; the feature only affects new contact relationships
Usernames are limited to 35 characters and have restrictions on high-profile names to reduce impersonation risk.
Setting a Username
To reserve a username, navigate to:
Settings → Account → Username
The feature will appear in app once it rolls out to your region.
Why This Matters for Security
Phone numbers are persistent identifiers tied to real-world identity. A number obtained through a data breach, scraped from social media, or purchased on an underground market could be used to:
- Initiate social engineering conversations
- Attempt SIM-swapping attacks by verifying account ownership
- Correlate WhatsApp activity with other platforms
Usernames decouple messaging from the phone number, limiting what an adversary can do with a leaked number. Combined with existing features like disappearing messages, two-step verification, and the newly expanding privacy checkup, this brings WhatsApp closer to Signal-level privacy defaults.
Context
WhatsApp has been steadily expanding its privacy model as regulators and users demand stronger protections. The European Union's Digital Markets Act has pushed Meta to make interoperability and privacy features available to EU users, but the username rollout is global from launch.
The timing is notable given the concurrent news of Russian FSB-linked groups actively targeting WhatsApp users through phishing attacks — usernames alone won't stop a sophisticated spear-phishing campaign, but reducing phone number exposure limits one of the key intelligence collection vectors those campaigns rely on.