WhatsApp Usernames Are Here: Hide Your Number

For sixteen years your phone number was your WhatsApp identity. To put someone in a group, swap details at a meetup, or sell a couch on a local chat, you handed over the same number that unlocks your bank OTP and sits in a hundred leaked databases. That trade is finally optional. This week WhatsApp opened username reservations to all three billion users, and a handle like @maya.builds is about to become a thing you can share instead of digits.

It is not live as a way to message yet. What just opened is the land-grab: pick your name now, use it when the feature switches on later this year. Here is what is real, what is still rolling out, and how to grab yours before someone else does.

What actually shipped this week

Two separate things are easy to mix up, so be precise about which one you have.

Reservations are open now. WhatsApp announced on its blog that you can claim a username today. In WhatsApp's words: "With over three billion people on WhatsApp a lot of names overlap, which is why we're opening reservations early so everyone has the opportunity to select the username that matters to them." Reserving does not change anything about your chats yet. It parks the name so nobody else takes it.

Messaging by username comes later this year. The actual feature, where a new contact reaches you by handle and never sees your number, rolls out gradually over the coming months. WhatsApp says it will notify you when it goes live in your country. Beta builds on Android and iOS started carrying the plumbing back in April, so this has been cooking for a while.

How to reserve yours

Update to the latest WhatsApp, then go to Settings → Account → Username. The whole thing takes a few seconds. WhatsApp's help page walks through it if you get stuck.

The naming rules are stricter than Instagram's, mostly to stop people from faking links and domains inside a handle:

• 3 to 35 characters long
• at least one letter (so a username can't be pure digits and look like a phone number)
• only lowercase letters, numbers, periods, and underscores
• can't start with www. or end in something like .com or .net

So aarav_dev, maya.builds, and kabir.97 are fine. 12345, WWW.shop, and diya.com are not. If you already have a name you use on Instagram or Facebook, WhatsApp lets creators, businesses, and organizations claim the matching handle so your identity stays consistent across Meta's apps.

The part that matters: no directory

Here is the design choice that makes this a privacy feature and not just a vanity handle. There is no search, no directory, no "people you may know" suggesting usernames. WhatsApp is blunt about it: "There's no directory to browse and no suggestions – people will need to know your exact username to contact you for the first time."

Think about what that prevents. On platforms with searchable handles, anyone can type a guess at your name and find you. Scrapers harvest those directories wholesale. WhatsApp's version flips it around. The handle is useless to a stranger unless you actually give it to them. You stay in control of who can start a conversation, the same way a phone number works, minus the part where the number is reused across your entire digital life.

Once messaging launches, the payoff is simple. When you start a chat with a new person or business, they no longer see your phone number, as long as you've enabled your username. The flow looks like this:

The username key: a second lock

WhatsApp also built an optional extra layer called a username key. Turn it on and someone needs two things to message you for the first time: your username and a separate key you choose. Knowing the handle alone isn't enough.

This is for the case where your username gets around more than you'd like. Say you put @maya.builds on a conference badge or a public profile. Without a key, anyone who reads it can ping you. With a key, you hand the key only to people you actually want hearing from, and the handle on its own is a dead end. It is opt-in, so most people will never touch it, but for anyone who shares a handle publicly it closes an obvious hole.

What it does not change

Worth being clear, because the headlines oversell it. Usernames protect you in new connections. People who already have your number saved keep it. Existing chats are unaffected. This isn't a button that retroactively scrubs your number from everyone's phone. It is a way to meet new people, join new groups, and contact new businesses without leaking the number going forward.

Quietly, this reshapes business messaging too

The consumer story is the privacy win. The bigger structural change sits on the business side. WhatsApp is rolling out business-scoped user IDs (BSUIDs), a stable identifier that lets a company message you without ever holding your phone number. Per WABetaInfo, the ID is tied to the user_id parameter and rides along in every message webhook.

If you build on the WhatsApp Business Platform, this is a real deadline, not a someday. Companies are being told to update their systems, CRM links, analytics, and support tooling, to handle usernames and BSUIDs through 2026 rather than keying everything off the phone number. The phone number is being demoted from "primary key" to "one of several identifiers," and code that assumed otherwise will break.

What I'd do this week

Reserve the handle you want. That's the whole urgent action. With three billion people racing for names, the good short ones go fast, and a reservation costs you nothing and commits you to nothing. Grab it, then forget about it until WhatsApp tells you the feature is live in your country.

If you run anything on the Business Platform, start the audit now. Find every place your code, your CRM, or your analytics treats the phone number as the unique customer ID, and plan the move to BSUIDs before the change forces your hand.

Phone-number-as-identity was always a privacy accident we all just lived with. It leaked into spam lists, it followed you across apps, it tied your chats to the one string that also guards your bank login. Untangling messaging from that number is overdue. If you care about who gets to put a stranger in your inbox, the security mindset here rhymes with the one we covered in prompt injection and LLM security: assume your identifiers leak, and design so a leak costs less. A handle you can revoke beats a number you can't.