The 64-digit key, explained — and how to handle it safely

Somewhere in WhatsApp's settings there is a screen showing sixty-four hexadecimal digits in groups of four. Most people see it once, screenshot it, and never think about it again. It is worth understanding, because it is the single thing standing between your entire message history and anyone who gets hold of your backup file.

What it is

When you turn on end-to-end encrypted backup, WhatsApp generates a 256-bit key on your phone. Every backup after that — the local msgstore.db.crypt15 file and the copy in your cloud account — is encrypted with a key derived from it.

Sixty-four hexadecimal digits is exactly 256 bits written out: each digit carries 4 bits, and 64 × 4 = 256.

The important property: WhatsApp does not keep a copy. That is what "end-to-end encrypted backup" means. If you lose the key and forget the password, nobody — not WhatsApp, not Google, not us — can decrypt that backup. It is genuinely gone.

Where to find it

On Android: Settings → Chats → Chat backup → End-to-end encrypted backup. If it is already on, tap through to view the key; you may have to re-enter your password or confirm your identity first.

If WhatsApp offers you a passkey instead of digits, switch: turn the encrypted backup off, then on again, and choose "Use 64-digit key" rather than the password or passkey option. A passkey is convenient for restoring to a new phone, but it is held inside your device's secure hardware and cannot be exported — so no other tool can use it to read your backup.

Why a reader app needs it

The backup file on your phone is not a database you can just open. It is ciphertext. Without the key, msgstore.db.crypt15 is noise.

WaChat asks for the key for one reason: to derive the decryption key and unwrap the file so it can read the SQLite database inside and turn it back into chats. That happens:

• In the browser, inside a Web Worker, using the WebCrypto API. The file never leaves the tab.
• Or in the Android app, where the key is wrapped by the Android Keystore.

The key is never sent to a server, never written to a log, and never included in crash reports. If you would rather not store it at all, don't — you can paste it each time and it lives only for the length of the session.

Rules for handling it

Never send it by email or chat. Not to us, not to support, not to anyone. Legitimate support will never ask for it. If someone does ask, that is the whole attack: your backup file is useless to them without the key, and the key is useless without the file.

Do not keep it in the same place as the backup. A screenshot of the key sitting in the same cloud album as an exported backup defeats the purpose entirely.

Do write it down. A password manager entry, or paper in a drawer. It is unrecoverable, and it is the only thing that will let you read your own archive in ten years.

Treat a screenshot as sensitive. Photo backups sync to the cloud, get shared into albums, and show up in "on this day" widgets on a screen someone else is looking at.

What happens if you rotate it

You can turn the encrypted backup off and on again to generate a fresh key. Old backup files stay encrypted with the old key — so if you keep archived copies, keep the old key with them, labelled.

In one line

The 64-digit key is a 256-bit secret that only you hold; it is the only way to read your own WhatsApp backup, nobody can recover it for you, and any tool worth using will keep it on your device.