WhatsApp is developing a guest-call feature that would let people without a WhatsApp account join encrypted calls through a web link.
This capability would extend WhatsApp’s existing Call Links feature to include guests, letting invited participants join calls directly from a browser without installing the mobile app or creating an account.
Currently, the feature is still in development and is not available to beta testers or the public. WhatsApp has not announced a release date, supported platforms, browser requirements, or limits on guest-call participation.
In the proposed workflow, a WhatsApp user would generate a call link from the app’s Calls tab, choose the call type, and then share the URL with another person. A recipient without WhatsApp could open that link in a browser, access a WhatsApp Web call interface, and request to join as a guest.
According to WABetaInfo, this model is similar to the guest-chat functionality that WhatsApp previously introduced for non-account holders. In guest chats, a person receives a browser link and can join an end-to-end encrypted conversation without registering for the platform.
WhatsApp Web generates a unique session identifier, which is part of the process for creating the encryption key that secures the conversation.
Guest calls are expected to operate on the same principle. Instead of requiring a persistent WhatsApp account, the service will generate a unique identifier for the browser session and use it to establish encryption for the call.
WhatsApp has said call content will remain end-to-end encrypted by default, meaning the platform will not have access to the audio or video exchanged between participants.
A key security feature is the mandatory approval step for every non-account guest. Unlike standard WhatsApp users who may enter a call using an existing link, a guest participant must send a request that the host must manually approve before joining.
This approval requirement is crucial because a call link could be forwarded, exposed in a message, or accessed by an unintended recipient. Since a guest does not have a conventional WhatsApp identity linked to the session, the host must decide whether to permit the person requesting entry.
Hosts will also retain controls available in regular calls. They can approve or reject join requests, remove disruptive participants, prevent those removed from rejoining, and end the call for everyone.
These controls will be especially important during business discussions, support calls, classrooms, and other situations where hosts may invite unfamiliar individuals.
While guest calls facilitate communication, they also introduce familiar link-security challenges: possessing the URL may be enough for an unauthorized attempt to join the call.
The mandatory approval process reduces unauthorized participation but does not verify a guest’s real-world identity or prevent impersonation.
Users are therefore advised to share call links through trusted channels, verify a guest’s identity before approving their request, and avoid publicizing links in open posts or groups.
Hosts should also treat unexpected guest requests with caution, particularly if a call involves sensitive business, financial, or personal discussions.
Unlike guest chats, which can remain active for up to 10 days of inactivity, guest calls are intended for real-time communication and will end when the call concludes. This feature could make WhatsApp a more accessible meeting platform while preserving its encryption model, provided users share links carefully and verify participants.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…