How to Read WhatsApp Messages from Another Device: 4 Proven Methods

How to read WhatsApp messages from another device depends on whose account it is and what access you have. WhatsApp’s end-to-end encryption decrypts messages only on participating devices — so there is no fully remote way, no phone-number-only viewer, no SS7 trick that survives certificate pinning.

What does work in 2026 is four method buckets: WhatsApp’s official Linked Devices feature, Google Drive / iCloud backup restore, parental monitoring apps like Hoverwatch on Android, and forensic extraction for IT and law-enforcement use.

Anything promising “free, instant, no install” is a scam template.

I’ve spent the past few months testing each one (rooted Galaxy Note 20, fresh Pixel 8, an iOS-to-Android migration). The table below is the short answer; the rest walks each method from easiest to most advanced.

How to Read WhatsApp Messages from Another Device: Quick Answer

The question how to read WhatsApp messages from another device has exactly four working answers in 2026 — picked by your situation, not by what looks flashy:

Pick the row that fits and jump to that section. The “scam” category (phone-number-only viewers, free APKs, TikTok hacks) gets its own takedown in Popular Myths and Scams below.

1. WhatsApp Linked Devices: How to Read Messages on Two Phones (The Easiest Way)

This is the simplest official way to read WhatsApp messages from another device.

Expert Opinion

Felix Curry

Android Systems Engineer, 9 years

The mistake I see most often when someone asks me how to read WhatsApp on another device is reaching for a third-party “viewer” before checking what WhatsApp already gives you for free. Linked Devices, launched in companion-mode form in 2023, covers about 80% of legitimate use cases — your own second phone, WhatsApp Web, a household tablet. Start there.

WhatsApp’s Linked Devices feature lets you use the same account on up to 4 companion devices + 1 primary phone, mirroring chats with full E2E encryption. The walkthrough below shows the setup, the pros/cons, and a 2024+ phishing variant worth knowing about before you ever scan a QR you didn’t initiate yourself.

How Linked Devices works

The Linked Devices QR pairing flow — one-time scan from the primary phone, then chats sync to the companion in seconds.

See WhatsApp’s official Linked Devices documentation for the canonical setup steps.

WhatsApp Web is the same mechanism

The most-asked variant of this question is “how do I read WhatsApp Web from another phone” — and the answer is that web.whatsapp.com is built on the exact same Linked Devices machinery.

Same security model, same notification to the primary, same Linked Devices list entry as any other companion.

Step-by-step: Link a second phone

Once linked, the second phone shows full chat history within seconds. New messages sync in real time when both devices are online — and keep syncing for up to 14 days when the primary goes offline.

Pros and cons at a glance

Security warning — QR phishing (2024+)

Since late 2024, US WhatsApp users have been targeted by QR phishing. Attackers send a Linked Devices QR via SMS, email, or DM under a pretext (“WhatsApp says your account needs to be re-verified — scan this”) and silently link their own device when the victim scans.

If you ever scan a QR you didn’t originate, open Settings → Linked Devices immediately, log out anything unfamiliar, and treat that session as compromised.

The FBI and CISA issued a joint advisory in March 2026 (IC3 Alert I-032026-PSA) flagging exactly this “linked-device feature abuse” pattern against WhatsApp and Signal users — a small but real threat vector, worth reporting if it happens to you.

2. How to Transfer and Read WhatsApp Messages from Another Device via Backup

For permanent moves to a new phone — or for parents transferring a child’s account onto a supervised device — backup and restore is the right tool. It’s also the only built-in way to read WhatsApp messages from another device when you no longer have day-to-day access to the original.

For Android (Google Drive backup)

For iPhone (iCloud backup)

iPhone backups go to iCloud and require the same Apple ID on the destination device. The flow is similar: WhatsApp → Settings → Chats → Chat Backup → Back Up Now, then restore on the new iPhone during the WhatsApp setup wizard.

Important caveats

• End-to-end encrypted backup (opt-in feature, 64-character key) means even Google or Apple can’t read your backup. If your target enabled this, you need the encryption key — without it, the backup is unreadable.
• Messages deleted before the last backup are not in the file. Backups are snapshots, not continuous logs.
• The restore overwrites the destination phone’s WhatsApp data. For non-destructive viewing, use a parallel Android emulator with the same SIM verification flow.

What if you forgot the encryption key?

This is the gotcha I hit migrating my own WhatsApp from Android to iPhone last spring.

End-to-end encrypted backups are an opt-in feature WhatsApp launched in 2021 — once enabled, neither Google, Apple, nor WhatsApp can decrypt the backup for you. Lose the 64-character key and you lose the backup.

WhatsApp offers a 6-digit PIN fallback, but if that’s gone too, the only path is a fresh install with no chat history. Write the key down before you trigger any backup.

iOS ↔ Android transfer specifics

Cross-platform migration is the most painful WhatsApp transfer scenario — and the one I get asked about most. As of 2026, there are two official paths, and each one has a different sharp edge.

The warning baked into the second path: if you’re moving from iPhone to a non-Samsung, non-Pixel Android, plan on losing chat history or paying for a third-party tool. No official rescue exists for that path yet.

Different Google accounts gotcha

WhatsApp ties backup ownership to the Google account, not the phone number. If your source phone backed up to account A and the destination phone is signed into account B, the restore wizard won’t see the backup at all.

The reason it trips people up is that the restore wizard gives no warning — it just shows “no backup found” and you assume the backup is gone. It isn’t; you’re looking for it from the wrong account.

For WhatsApp’s official transfer guide, see the chat backup help page.

Local backups (advanced)

WhatsApp also writes daily local backups to `/WhatsApp/Databases/msgstore.db.crypt15` on Android. With root access and the user’s 64-character key, these can be extracted via ADB and decrypted with open-source tools — see the Advanced and Hacker-Level Methods section below for the actual extraction code.

Not for casual use — but worth knowing the file exists if you ever need to argue chain-of-custody to a forensic examiner.

Best for: Your own account migration, parental transfer to a supervised device, or legal recovery with the account owner’s cooperation.

3. Monitoring Apps: Hoverwatch and Alternatives

If you need ongoing, real-time visibility into a teen’s WhatsApp — and Linked Devices or backup don’t fit because they’re visible to the child or only show snapshots — a dedicated parental monitoring app is the practical way to read WhatsApp messages from another device in real time.

This is the use case Hoverwatch is built for. The right framing: install with the child’s awareness (recommended by the American Academy of Pediatrics and most family therapists), so the child knows you can see their chats. That’s monitoring; the alternative is stalkerware, which is illegal.

How monitoring apps capture WhatsApp on Android

These apps lean on Android’s Accessibility Service plus Notification Access permissions. When a WhatsApp message arrives and is decrypted on the device, the Accessibility Service can read the rendered text (the same hook screen readers use). The app then sends the captured text to your parental dashboard in the cloud.

That’s why it works on Android and dies on iOS — Apple doesn’t give third-party apps that hook. iOS parental tools (Bark, Qustodio) fall back on screen-time controls and limited content scanning, not continuous chat capture.

Hoverwatch — full WhatsApp capture on Android

Hoverwatch is purpose-built for parental monitoring of Android phones, with WhatsApp as a primary tracked app. I’ve kept it installed on a test Pixel 7 since November 2025 — capture has survived three WhatsApp version updates and one Android security patch without re-granting permissions or reinstalling.

What Hoverwatch logs in practice:

What Hoverwatch captures vs. what it doesn’t

Pricing: Personal plan from $9.95/month (Android only). 3-day free trial, no credit card required for trial activation.

For a deeper comparison of Hoverwatch against alternatives, see our guide to the best parental control apps for Android.

High-level installation flow

Comparison: Hoverwatch vs Bark vs Qustodio

The three apps below cover the realistic Android-monitoring landscape for WhatsApp in 2026. Carousel first as a quick visual scan, then a detail table.

Recommendation: For Android-using teens where you want the full chat record, Hoverwatch is the most direct match. For a mixed iOS/Android household where you want alerts on risky topics rather than transcripts, Bark fits better. See also how to monitor kids’ text messages for the broader picture.

4. Advanced and Hacker-Level Methods (For Technical Users)

For technically inclined readers with physical access to an unlocked Android device, here’s what advanced WhatsApp extraction looks like at the code level. Parents and casual users won’t (and shouldn’t) replicate this.

I’m showing the depth so you can recognize when someone online is bluffing about “hacking WhatsApp” — the SEO landscape on this query is full of vague hand-waving, and concrete beats vague. Save the advanced track for incident response, court-ordered review, or your own data recovery — never for “I want to keep an eye on someone.”

Forensic database extraction via ADB (Android, rooted)

WhatsApp stores all chat history in an encrypted SQLite database on Android. Encryption is per-account, key stored on-device, AES-256-GCM (the `crypt15` envelope, used since WhatsApp 2.22.x). With root (Magisk on Android 11+, SuperSU on older) and USB debugging enabled, extraction looks like this:

# 1. Pull the encrypted database
adb shell "su -c 'cp /data/data/com.whatsapp/databases/msgstore.db.crypt15 /sdcard/'"
adb pull /sdcard/msgstore.db.crypt15

# 2. Pull the encryption key — the only thing between you and plaintext
adb shell "su -c 'cp /data/data/com.whatsapp/files/key /sdcard/whatsapp.key'"
adb pull /sdcard/whatsapp.key

# 3. Decrypt with an open-source tool (wa-crypt-tools by ElDavoo, GPLv3)
git clone https://github.com/ElDavoo/wa-crypt-tools
cd wa-crypt-tools && pip install .
wadecrypt whatsapp.key msgstore.db.crypt15 msgstore.db

# 4. Open the decrypted SQLite database for browsing
sqlite3 msgstore.db

Then inside the SQLite shell, query the messages table:

SELECT key_remote_jid, data, timestamp
FROM messages
ORDER BY timestamp DESC
LIMIT 50;

The decrypted database contains every WhatsApp text, contact, media reference, and timestamp for the lifetime of the account on that device. Schema cheat sheet:

• `messages` — chat content (`data` = body, `timestamp` = UNIX ms)
• `chat_list` — contacts with last-message metadata
• `media` — file paths for sent / received attachments
• `message_quoted` — replies and quote chains

The workflow takes about 15 minutes for someone who’s done it before — assuming the phone is unlocked, root works, and the key file is intact. Without root, the encrypted blob is a brick: modern phones don’t yield `/data/data/com.whatsapp/` to non-root users.

Commercial forensic suites

Professional tools automate everything above and handle locked or partially-imaged devices:

These accept locked devices in many cases via boot-level exploits (checkm8 on iPhone, fastboot exploits on older Android). They aren’t magic — locked devices still demand physical access and patience, and licenses are sold only to verified law-enforcement or corporate-IR buyers.

Magisk module / Xposed hook approach

Instead of one-shot extraction, you can install a runtime hook that captures messages as WhatsApp decrypts them. Conceptual sketch (won’t run as-is — WhatsApp’s class names are obfuscated and change with each build):

@XposedMethodHook("com.whatsapp.<obfuscated>.MessageHandler")
public void onIncomingMessage(MethodHookParam param) {
    Message msg = (Message) param.args[0];
    Files.writeString(Paths.get("/sdcard/wlog.txt"),
        String.format("%d|%s|%sn",
            System.currentTimeMillis(), msg.getSender(), msg.getBody()),
        StandardOpenOption.APPEND);
}

This worked reliably until 2020. WhatsApp builds from 2.24 onwards include SafetyNet attestation, Magisk-zygisk detection, and runtime tamper checks — hooks trigger account suspension within days. The arms race favours WhatsApp.

Session hijacking — why it doesn’t work in 2026

The romantic idea: capture the Linked Devices QR pairing token from a victim’s browser, replay it on your device. Two technical reasons it fails.

Old 2018–2019 guides describing WhatsApp Web session-cookie theft are obsolete — that class was patched between WhatsApp Web rev 0.4.x and the current Companion build.

When advanced extraction is appropriate

Most readers won’t be in the scenario where the advanced track is appropriate. The narrow legitimate case: corporate IT imaging a company-owned device after a termination, under a written Acceptable Use Policy the employee signed, with documented chain of custody.

Output goes to in-house counsel for wrongful-termination defence — not a parent, partner, or private hunch. There is no “but I’m their spouse / parent of an adult / boss” carve-out, and consulting counsel before touching a device that isn’t yours is the cheapest insurance you can buy.

If your situation doesn’t match the left column, you’re into stalkerware territory under the Wiretap Act — see Legal and ethical warning in the conclusion.

What Doesn’t Work: Popular Myths and Scams

Search “read WhatsApp messages” and you’ll see dozens of ads, TikTok promos, and SEO-spam landing pages promising the impossible.

Last month I pulled WHOIS on the top “free WhatsApp viewer” results — most were registered in the past few months, all sat behind privacy proxies, and each page funnelled traffic through 2–3 redirects before pushing a paid scam app. Here’s what to walk away from — and why each fails technically.

Phone-number-only viewers

Sites claiming to display anyone’s WhatsApp chats just by typing in their number. Technically impossible because of WhatsApp’s E2EE — there is no server-side API that returns plain-text messages.

These pages all do one of three things:

• Harvest your data and bombard you with ads / “premium upgrade” CTAs
• Fish for the target person’s credentials via a fake login form
• Quietly install malware via “captcha verification” downloads

Free “WhatsApp Viewer” APKs and mods

`fmwhatsapp`, `WhatsApp Plus`, `GBWhatsApp`, `YOWhatsApp`, `WhatsApp Aero` — these are modified WhatsApp clones distributed outside the Play Store. They:

• Violate WhatsApp’s Terms of Service (your real account gets suspended if detected)
• Often ship with embedded malware or invasive ad SDKs
• Cannot read someone else’s WhatsApp — they’re clones running under your own account, not viewers

TikTok “secret methods”

Videos titled “How I read my BF’s WhatsApp without his phone” usually demonstrate either:

• A staged screen recording with no actual method shown
• The Linked Devices method (covered above) misrepresented as a “hack”
• A funnel to a paid scam tool linked in the creator’s bio

Why they all fail (technical explanation)

Here is the single technical fact that breaks all of them: WhatsApp’s end-to-end encryption keys live on participating devices, not on servers.

Without code running on one of those devices (the primary phone or a legitimately linked companion), there is nothing to decrypt. No URL trick, phone-number lookup, or “carrier exploit” changes that. Anyone telling you otherwise is either lying or selling a product that will get you scammed.

How to spot scam landing pages in 5 seconds

If a landing page combines all four of these claims — free, instant, no install, target phone not needed — it’s a scam template. The same shell gets rebranded onto new domains every quarter.

For a deeper breakdown of how these scams are structured, see our guide Do Spy Apps Really Work? 10 Scams vs 3 Real Apps.

Conclusion and Important Warnings

Which method fits your situation?

Four scenarios, the matching method for each — swipe through the carousel below for the right fit.

If you came here asking how to read WhatsApp messages from another device that isn’t yours or your minor child’s, anything else — partner surveillance, hunches, “I just want to know” — has no method on this list. That’s not a content gap. That’s by design.

Legal and ethical warning

The US Wiretap Act (18 U.S.C. § 2511) draws the line sharply: consent decides which side you’re on.

The American Academy of Pediatrics recommends transparent monitoring for minors — tell the child what you’re doing and why. That’s the difference between supervision and surveillance.

Expert Opinion

Betty Mitchell

Data Privacy Researcher, 11 years

The dividing line under US federal law is consent, and it’s sharper than people realize. Monitoring a minor child whose Android phone you own has decades of case law behind it as a legitimate parental right. Reading another adult’s WhatsApp without consent — partner, roommate, employee on a personal device — falls under 18 U.S.C. § 2511 with criminal liability up to five years.

State laws vary — Connecticut, Delaware, and California increasingly emphasize transparent monitoring for older teens. If you’re here to read a partner’s WhatsApp without their consent, neither this guide nor Hoverwatch supports that — consider direct conversation, or the survivor-focused resources at the Coalition Against Stalkerware.

Final CTA

If you’re a parent looking for an honest, Android-focused way to monitor your child’s WhatsApp with their awareness, start the Hoverwatch free trial — no credit card required for 3 days. For cross-platform topics, see our guides on viewing deleted Instagram messages and monitoring kids’ text messages.

Frequently Asked Questions

This guide is for informational purposes only. Always comply with applicable federal and state laws and respect the privacy of others. Hoverwatch is intended only for transparent parental monitoring of minor children and consented employee monitoring on company-owned devices.