What are WhatsApp usernames and how do they protect privacy?

WhatsApp usernames are public handles (format @name) that let new contacts find you without needing your phone number. According to the observed architecture, the number is hidden from new contacts via username, but remains visible to existing contacts. Meta still sees all metadata. Username protects you from other users, not from the platform.

What new attack surfaces do WhatsApp usernames create?

Three main surfaces. First, squatting without a dispute mechanism — unlike domains with UDRP, there is no recourse to reclaim appropriated handles. Second, visual similarity attacks (@chase.bank vs @chasebank) that WhatsApp's conversation context makes more convincing than email phishing. Third, cross-platform linking — the same username on WhatsApp and Instagram reveals the connection between accounts you may want to keep separate.

What is the Username Key and why does it matter?

The Username Key is a 4-digit code that strangers must provide before sending the first message via username. It is the genuine innovation of the launch — an anti-spam gate that Signal does not have. Without the Username Key, anyone with your handle can message you. With it, the handle alone is not enough. Activate it in privacy settings and share the code only with trusted contacts.

How does the BSUID change business communications on WhatsApp?

The BSUID (Business-Scoped User ID) replaces phone numbers in webhooks. The format is whatsapp:CC.BSUID, up to 128 characters. Businesses get a stable identifier without seeing the customer's number — a real privacy win for the consumer side. Authentication templates still require the number, so the transition is not complete. Engineering teams need to update webhooks and CRM systems while maintaining compatibility.

How does WhatsApp's approach compare to Signal and Telegram?

According to the observed architecture, Meta copied Signal's privacy model — no directory, no search — not Telegram's discovery model, which has public search and a username marketplace. Telegram has discovery but no E2EE by default. Signal has privacy but no Username Key. WhatsApp combined directory-free privacy with the Username Key, creating an anti-spam gate that neither competitor offers.

[email protected]

Talk to an Expert

Oops! Something went wrong.

An unexpected error occurred. Our engineering team has been notified automatically.

Tech86 Specialist

We Value Your Privacy

We use cookies and similar technologies to optimize your experience, analyze site traffic, and personalize content. By clicking "Accept All", you agree to the use of all cookies. Read our Privacy Policy.