The feature – which WhatsApp started beta-testing towards the end of 2016 – is now live to all users. It allows them to create six-digit codes to verify their phone numbers (WhatsApp works with your phone number anyway) or use a recovery email address instead. To enable two-step verification, all you have to do is open WhatsApp, go to your Account Settings, and turn it on.
Following this, you can then also add an email address to use as a backup. If you are unable to access the six-digit passcode that you had set up, you can use this email to disable the two-step verification. If you want to use this option, you will need to make sure you use the right email address, as WhatsApp will “not verify this email address to confirm its accuracy.” If, for any reason, you entered the wrong email, you will have a problem.
WhatsApp says that you need to be vigilant about receiving an email to your backup email address to “disable two-step verification,” and that “if you did not request this, do not click on the link. Someone could be attempting to verify your phone number.”
Also, it’s important to remember that “if you have two-step verification enabled, your number will not be permitted to reverify on WhatsApp within seven days of last using WhatsApp without your passcode.” If you forget you passcode but haven’t added a backup email address, WhatsApp says that you “will not be permitted to reverify on WhatsApp within seven days of last using WhatsApp.” You can reverify after those seven days, but you will loose all messages in that timeframe.
However, once you have selected a passcode, WhatsApp will help you remember it – by asking you to enter it once in a while. You won’t be able to disable this, without disabling two-step verification.