replaces your number
per username
reserve early
What WhatsApp usernames actually are
For seventeen years, your identity on WhatsApp was one thing: your phone number. It was your login, your address, your business card, and your privacy liability, all in a single string of digits. Usernames change that. A username is an optional handle — something like @yourbrand — that you can hand out instead of your number when you meet someone new.
Anyone who knows your exact username can search for it and start a conversation, without ever seeing your phone number. Your number stays linked to the account for login, verification and recovery, but it is no longer the thing you give away every time you want to talk. The feature is optional — you can keep using WhatsApp exactly as before if you don’t create one. Telegram has had usernames since 2013 and Signal since 2022; WhatsApp, with roughly three billion users, is the last of the major apps to add them.
How to reserve your WhatsApp username (step by step)
Reservations rolled out ahead of the live feature on purpose — so handles get claimed before the land rush. Here’s the exact path:
- Update WhatsApp to the latest versionFrom the Play Store or App Store. The option won’t appear on older builds.
- Open Settings → Account → UsernameThis must be done on your phone — it is not available on WhatsApp Web or Desktop.
- Pick your handle — or claim your Instagram / Facebook oneBusinesses and creators can link their Meta accounts to keep the same handle across WhatsApp, Instagram and Facebook.
- Confirm to reserve itReserving secures the name. Your number only actually hides once the feature goes fully live in your country and you enable it.
If you don’t see the option yet, that’s normal. The rollout is phased — not every account has the menu on day one. It’s rollout pacing on WhatsApp’s side, not a problem with your account or app.
The username rules
The format rules matter, because clean, common handles go fast once the global rollout hits:
| Rule | Detail |
|---|---|
| Length | 3 to 35 characters |
| Must contain | At least one letter |
| Allowed characters | Lowercase letters, numbers, periods and underscores |
| Not allowed | Can’t start with “www.” or end in a domain like “.com” / “.net” |
| Reserved | Held back for celebrities, public figures, government and notable organisations |
| Cross-Meta | To keep one identity, you can claim your existing Instagram or Facebook handle |
The Username Key & how the privacy model works
WhatsApp deliberately refused to build a searchable directory. There is no public list of usernames and no autocomplete — someone needs your exact handle to contact you the first time. On top of that sits an optional Username Key: a short code that lives alongside your username. Even if someone knows your @handle, they need the key to start a conversation; messages from keyless senders land in a Requests folder instead of your main inbox.
Important nuance: the Username Key is an anti-spam control, not an anti-impersonation one. It decides who can message you — it does nothing to stop someone copying your identity and using a lookalike handle to fool a third person. That distinction is at the centre of the debate below.
The debate: a privacy win, or an impersonation risk?
This is genuinely two-sided, and it’s worth understanding both halves before you decide how to use the feature.
The privacy case (for). Handing out a username instead of a number reduces how often your phone number is exposed — which is what fuels SIM-swap attacks, phishing and unwanted contact. Security researchers have called it a net privacy gain for exactly that reason, and it brings WhatsApp in line with Telegram and Signal, where number-free messaging has been normal for years.
The impersonation case (against). On 1 July 2026, India’s Ministry of Electronics and IT (MeitY) asked WhatsApp to put the feature on hold, warning it could “materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks.” In early testing, lookalike handles resembling politicians, celebrities and institutions — even names like “rbi_verify” — were reportedly still available to grab. Founders and creators piled in: one prominent creator called it a potential “disaster” if strong anti-abuse systems aren’t in place, picturing scam messages from near-identical variants of a known name; another founder flagged that verified handles sitting next to almost-identical unverified ones will confuse ordinary users.
There’s a reasonable counter-view too: some policy voices argue the impersonation risk should be weighed against a real, structural privacy benefit — and that impersonation is best met by enforcing the law against fraudsters, not by blocking a feature outright. The honest summary: usernames remove one built-in trust signal (a visible phone number) and replace it with a handle that anyone can approximate. For a business, that raises the value of being officially verified, not lowers it.
Brand & username squatting — the trademark gap
Here’s the part every business owner should sit with. Unlike web domains — which have a mature dispute system (ICANN’s UDRP) for clawing back a name that infringes your trademark — messaging-platform handles have no equivalent. Username disputes are governed almost entirely by the platform’s own terms of service, with no standardised, external arbitration. It is first-come, first-served, at the scale of billions of users.
If you hold a registered trademark in India, you do have recourse — a squatted brand handle can be challenged as infringement under Section 29 of the Trade Marks Act, 1999. But that’s a legal process after the fact, not a one-click takedown. The practical defence is simpler and immediate: reserve your real brand handle now, before someone else does. Multiple Indian founders have already reported that close variations of their own names were taken within the first days of reservations opening.
What this means for your business
Strip away the noise and there are four concrete actions for any business on WhatsApp:
- Reserve your business handle — and the obvious misspellingsYour handle is becoming the “address” you print on ads, bios and cards. Grab the canonical name and common look-alikes before a squatter does.
- Claim your Instagram / Facebook handle for consistencyOne identity across Meta’s apps is easier for customers to trust and remember.
- Understand BSUID — the change your tools must handleSee below. If your CRM or automation isn’t ready for it, you risk losing the thread on new conversations.
- Lean harder on being an official, verified WhatsApp businessIn a world of lookalike handles, the green tick and Official API are your trust moat.
The BSUID change (the technical part that matters)
Alongside usernames, Meta introduced the Business-Scoped User ID (BSUID) — a new identifier that businesses receive for a customer instead of relying on the raw phone number. If you run a CRM, chatbot or WhatsApp automation, your tools need to recognise and store the BSUID, with compliance landing around mid-2026. The reassuring part: businesses that already have a customer’s phone number from an existing conversation keep it and can keep messaging them; you can still send to numbers you already know; and authentication (OTP) messages continue to go to phone numbers as before. What changes is how brand-new, username-first contacts are identified — and that’s exactly the plumbing a proper platform handles for you so no lead slips through.
Where FLO fits. FLO runs on the Official WhatsApp Business API, so it’s built to handle the BSUID transition and keep your contacts and conversations intact — while the verified, official-account trust signal (which usernames make more valuable, not less) is exactly what FLO is designed around.
Your 6-point brand-protection checklist
- Reserve the canonical brand handlePlus 2–3 common misspellings and your main campaign/product names.
- Claim your Instagram / Facebook handle on WhatsAppLink your Meta accounts to keep one identity.
- Enable the Username Key on the business accountCuts down unsolicited first-contact spam.
- Assign two owners + turn on MFAA primary and backup for the handle, logged in your access records.
- Update your links everywhereSwap phone-number links for the username on your site, bios, emails and ads.
- Monitor for lookalikesWatch for near-identical handles impersonating your brand, and report them.