[role="xpack"]
[[security-api-change-password]]
=== Change passwords API

Changes the passwords of users in the native realm.

==== Request

`POST _xpack/security/user/_password` +

`POST _xpack/security/user/<username>/_password`


==== Description

You can use the <<security-api-put-user,create user API>> to update everything 
but a user's `username` and `password`. This API changes a user's password.

For more information about the native realm, see 
{stack-ov}/realms.html[Realms] and <<configuring-native-realm>>. 


==== Path Parameters

`username`::
  (string) The user whose password you want to change. If you do not specify
  this parameter, the password is changed for the current user.


==== Request Body

`password` (required)::
  (string) The new password value.


==== Authorization

Every user can change their own password. Users with the `manage_security`
privilege can change passwords of other users.


==== Examples

The following example updates the password for the `jacknich` user:

[source,js]
--------------------------------------------------
POST /_xpack/security/user/jacknich/_password
{
  "password" : "s3cr3t"
}
--------------------------------------------------
// CONSOLE
// TEST[setup:jacknich_user]

A successful call returns an empty JSON structure.

[source,js]
--------------------------------------------------
{}
--------------------------------------------------
// TESTRESPONSE