WhatsApp utilizes a multi-device architecture that distinguishes between primary and secondary devices. The primary device is always the smartphone, which holds the account identity and the root key.
Secondary devices, such as web or desktop clients, function as companions. They do not possess the account's root key but instead receive a signed pass from the primary device to access the account.
Authentication methods differ by role: the primary device uses standard account credentials, while secondary devices connect via QR code scanning. The primary device manages all device linking and unlinking.
End-to-end encryption relies on the Signal protocol, with transport secured by the Noise handshake and device signatures based on the Curve25519 elliptic curve. Each device receives its own encrypted messages.
The primary device maintains full control, including key management and the ability to operate independently. Secondary devices act as delegates with limited rights, unable to manage the account itself.
