[role="xpack"]
[[security-api-change-password]]
=== Change passwords API
++++
<titleabbrev>Change passwords</titleabbrev>
++++

Changes the passwords of users in the native realm and built-in users.

[[security-api-change-password-request]]
==== {api-request-title}

`POST /_security/user/_password` +

`POST /_security/user/<username>/_password`


[[security-api-change-password-prereqs]]
==== {api-prereq-title}

* Every user can change their own password. Users with the `manage_security`
privilege can change passwords of other users.

[[security-api-change-password-desc]]
==== {api-description-title}

You can use the <<security-api-put-user,create user API>> to update everything 
but a user's `username` and `password`. This API changes a user's password.

For more information about the native realm, see 
<<realms>> and <<native-realm>>. 


[[security-api-change-password-path-params]]
==== {api-path-parms-title}

`username`::
  (Optional, string) The user whose password you want to change. If you do not specify
  this parameter, the password is changed for the current user.


[[security-api-change-password-request-body]]
==== {api-request-body-title}

`password`::
  (Required, string) The new password value.


[[security-api-change-password-example]]
==== {api-examples-title}

The following example updates the password for the `jacknich` user:

[source,console]
--------------------------------------------------
POST /_security/user/jacknich/_password
{
  "password" : "s3cr3t"
}
--------------------------------------------------
// TEST[setup:jacknich_user]

A successful call returns an empty JSON structure.

[source,console-result]
--------------------------------------------------
{}
--------------------------------------------------