Forgot Your WhatsApp PIN? How to Reset Two-Step Verification

You changed phones, typed in the SMS code, and WhatsApp stopped you with one more screen: enter your two-step verification PIN. You set it years ago, or you do not remember setting it at all, and every guess is wrong.

You can usually still get in. First try the other verification methods WhatsApp offers on that screen: a code by email, SMS or voice call. If none of them work, WhatsApp unlocks a "Reset account" option after a waiting period. The wait is fixed, and the reset can cost you some messages, so it helps to know which route you are on before you tap anything.

This guide explains the PIN versus the SMS code, each reset route, what to do about a PIN you never set, and the scams aimed at people stuck here.

Last checked: 29 September 2026.

#How Do You Reset a Forgotten WhatsApp Two-Step Verification PIN?

On the PIN or password screen, tap "Verify another way", choose email, SMS or voice call, tap "Continue" and enter the code you receive. That is the fast route, and WhatsApp's page on a forgotten two-step verification password describes it. If you cannot complete any of those, WhatsApp says the option to reset your account unlocks after a few days; you then tap "Verify another way", "See more" and "Reset account". The reset cannot be undone and may delete recent messages. WhatsApp describes no way to shorten the wait, and nobody outside WhatsApp, including AwareXone, can skip it for you. You need a working SIM with the same number throughout.

#The PIN Is Not the SMS Code

Most confusion on this screen comes from two different codes. WhatsApp's page on registration and two-step verification says you see two separate screens when you log in:

• Registration: WhatsApp sends a 6-digit code by SMS or phone call to prove you own the number. If you added and verified an email earlier, it can send that code by email instead. This code changes every time.
• Two-step verification: an optional extra check that appears only after registration succeeds. This is the PIN or password you chose yourself when you turned the feature on. WhatsApp never sends it to you.

So a fresh SMS code will never work in the PIN box, and requesting more SMS codes will not reveal the PIN. WhatsApp's two-step verification page adds that the extra check can now be your phone number, a password or an email address.

#What You See and What to Do

Exact wording varies by app version, phone and language. People search for "Forgot PIN?", "lupa PIN WhatsApp" or "忘记WhatsApp两步验证PIN"; at the time of writing, WhatsApp's help page names the button "Verify another way". Match on the meaning.

#Decision Guide: Which Route Is Open to You?

Work down this list. Stop at the first line that is true.

1. Do you remember the PIN or password? Enter it. If you are not sure, try the one you most likely used, but do not guess endlessly.
2. Does "Verify another way" offer email, and can you open that inbox today? Choose email. WhatsApp's page on adding an email says the code goes only to the address on the account, and a friend's or relative's email cannot be used.
3. Is SMS or voice call offered, and does the SIM with your number receive messages right now? Choose one and enter the code.
4. None of the above? You are on the reset route. Keep the SIM active and in the phone, and come back when "Reset account" appears.
5. No longer have the SIM or the number? That comes first. WhatsApp's compromised account page says it is not possible to recover an account without a SIM card with the same phone number.

#Route 1: Verify Another Way by Email, SMS or Voice Call

This is the only route that gets you in immediately. WhatsApp lists these steps:

1. On the PIN or password screen, tap "Verify another way".
2. Select email, SMS or voice call.
3. Tap "Continue".
4. Enter the code you received.

If the SMS never arrives, WhatsApp's page on registration problems suggests checking that the SIM is active and can receive SMS or calls, that a prepaid line has enough balance to receive them, and that roaming is on if you are abroad. It also says your mobile provider can confirm whether messages to your number are blocked or delayed. In Malaysia, check that a prepaid line has not expired, top up if needed and restart the phone before you try again.

Once you are back in, WhatsApp says you can create a new password without entering the old one: on Android tap your profile, then "Account", "Password", "Change password"; on iPhone tap "You", then the same items.

#Route 2: Wait, Then Reset Your Account

If you cannot complete two-step verification any other way, WhatsApp's forgotten password page says the reset option "will unlock after a few days" and that it cannot be undone. Its compromised account page gives a more specific figure for accounts where someone else set the PIN: wait 7 days, then try again. Plan for about a week.

1. Keep the same SIM active and in the phone for the whole wait.
2. When the time is up, open WhatsApp, register with the SMS code, and at the PIN screen tap "Verify another way", then "See more".
3. Tap "Reset account", then "Continue", then "Reset account" twice more to confirm.

WhatsApp does not describe any appeal, form or support request that shortens the wait. Reinstalling the app, clearing its data or switching phones is not a workaround either; WhatsApp's compromised account page says reinstalling will not recover the account.

#WhatsApp Asking for a PIN You Never Set

If you are sure you never turned on two-step verification, there are two likely explanations.

• Someone took over your account. WhatsApp's compromised account page says an unauthorised user may enable two-step verification to keep the real owner out, and that the owner then needs to wait 7 days. The same page says that, whether you know the PIN or not, anyone using your account is logged out once you enter the 6-digit SMS code. Our guide to getting a hacked WhatsApp back covers warning contacts and the rest of that recovery, and the "no longer registered on this phone" guide explains the logout that usually comes first.
• The number used to belong to someone else. WhatsApp's page on seeing your number already in WhatsApp says mobile providers commonly recycle numbers, and that if the previous owner set up two-step verification you need to wait a few days after verifying before you can use it. The previous owner cannot read your chats. If you recently took over an old prepaid number, our guide to a recycled phone number in Malaysia explains what else to check.

#After You Are Back In: Set It Up So This Never Happens Again

Most people stuck on this screen had two-step verification on but no email attached. Fix that first. WhatsApp's page on managing two-step verification gives the path.

• Add an email you control: Settings, "Account", "Email address", "Add email", then enter the six-digit code WhatsApp sends to that inbox. This is what makes "Verify another way" by email possible next time.
• Replace the old PIN with a password: WhatsApp's password page lists Settings, "Account", "Password", "Create password". Adding a password turns two-step verification on.
• Consider a passkey. WhatsApp's passkey page says it links the account to your phone's fingerprint, face or screen lock, and can be used instead of an SMS code when registering or restoring the account.
• Check linked devices and set a voicemail password that is hard to guess, both from WhatsApp's account security tips.

If WhatsApp shows "2FA can't be set at this time. Please try again later.", its page on delays during two-step verification says you may have to wait a few hours after re-registering before you can set it up. For the same protection on your other accounts, see our walkthrough of two-factor authentication on Instagram, Facebook and TikTok.

#Mistakes That Make the Wait Longer or the Loss Bigger

• Typing the SMS registration code into the PIN box, or the reverse. They are different codes.
• Guessing registration codes until WhatsApp shows "You have guessed the code too many times." WhatsApp says there is no way to make that wait faster.
• Letting the prepaid SIM lapse, or swapping numbers, during the reset wait.
• Resetting without first backing up chats on an old phone that is still logged in.
• Reporting your own account while trying to recover it. WhatsApp warns this could get the account banned.
• Paying anyone who says they can remove the PIN or skip the wait.

#If You Paid Someone or Shared a Code in Malaysia

Deal with any money first. The NSRC's FAQ on the NFCC website says to contact your bank's 24-hour hotline or the NSRC on 997 immediately, then make a police report at the nearest station within 24 hours. It adds that NSRC, the police and banks will never ask for your password, PIN, TAC or OTP.

If a so-called PIN remover sent you a fake WhatsApp login page or an app to install, you can report it to CyberSecurity Malaysia's Cyber999 incident response centre by online form, email, phone or its mobile app. If you shared a registration code, log back in with a fresh code from your own SIM as soon as you can, because that logs out the other device.

#When a Case Review Makes Sense

A forgotten PIN on your own account needs no outside help: verify another way, or wait and reset. A second opinion is useful when the PIN appeared after a takeover that also reached your Instagram or Facebook, when the number is a business line customers use for orders, or when your carrier cannot tell you whether the SIM is still yours. SocialSafe by AwareXone, our recovery service, reviews what happened and tells you honestly which official routes remain. We cannot shorten WhatsApp's wait. Our recovery hub explains the case review, and our Trust Center sets out what we will never ask for, including your WhatsApp code and PIN.

#Frequently Asked Questions