diff --git a/account/account.go b/account/account.go
index 5b70f78..b838a29 100644
--- a/account/account.go
+++ b/account/account.go
@@ -304,6 +304,24 @@ func (s AccountServiceDefault) UpdateAccountEmail(userId uint, email string, pas
 	return s.updateAccountInfo(userId, update)
 }
 
+func (s AccountServiceDefault) UpdateAccountPassword(userId uint, password string, newPassword string) error {
+	valid, _, err := s.ValidLoginByUserID(userId, password)
+	if err != nil {
+		return err
+	}
+
+	if !valid {
+		return NewAccountError(ErrKeyInvalidPassword, nil)
+	}
+
+	passwordHash, err := s.HashPassword(newPassword)
+	if err != nil {
+		return err
+	}
+
+	return s.updateAccountInfo(userId, models.User{PasswordHash: passwordHash})
+}
+
 func (s AccountServiceDefault) AddPubkeyToAccount(user models.User, pubkey string) error {
 	var model models.PublicKey
 
diff --git a/api/account/account.go b/api/account/account.go
index 917932d..d538099 100644
--- a/api/account/account.go
+++ b/api/account/account.go
@@ -334,6 +334,22 @@ func (a AccountAPI) updateEmail(c jape.Context) {
 	}
 }
 
+func (a AccountAPI) updatePassword(c jape.Context) {
+	user := middleware.GetUserFromContext(c.Request.Context())
+
+	var request UpdatePasswordRequest
+
+	if c.Decode(&request) != nil {
+		return
+	}
+
+	err := a.accounts.UpdateAccountPassword(user, request.CurrentPassword, request.NewPassword)
+	if c.Check("failed to update password", err) != nil {
+		return
+	}
+
+}
+
 func (a *AccountAPI) Routes() (*httprouter.Router, error) {
 	loginAuthMw2fa := authMiddleware(middleware.AuthMiddlewareOptions{
 		Identity:     a.identity,
@@ -416,6 +432,7 @@ func (a *AccountAPI) Routes() (*httprouter.Router, error) {
 		"POST /api/account/password-reset/request": middleware.ApplyMiddlewares(a.passwordResetRequest, corsMw.Handler, middleware.ProxyMiddleware),
 		"POST /api/account/password-reset/confirm": middleware.ApplyMiddlewares(a.passwordResetConfirm, corsMw.Handler, middleware.ProxyMiddleware),
 		"POST /api/account/update-email":           middleware.ApplyMiddlewares(a.updateEmail, corsMw.Handler, authMw, middleware.ProxyMiddleware),
+		"POST /api/account/update-password":        middleware.ApplyMiddlewares(a.updatePassword, corsMw.Handler, authMw, middleware.ProxyMiddleware),
 
 		"GET /*path": middleware.ApplyMiddlewares(getHandler, corsMw.Handler),
 	}
diff --git a/api/account/messages.go b/api/account/messages.go
index 1453230..ca3bed4 100644
--- a/api/account/messages.go
+++ b/api/account/messages.go
@@ -62,3 +62,7 @@ type UpdateEmailRequest struct {
 	Email    string `json:"email"`
 	Password string `json:"password"`
 }
+type UpdatePasswordRequest struct {
+	CurrentPassword string `json:"current_password"`
+	NewPassword     string `json:"new_password"`
+}
diff --git a/api/account/swagger.yaml b/api/account/swagger.yaml
index d91431b..c8ebaa2 100644
--- a/api/account/swagger.yaml
+++ b/api/account/swagger.yaml
@@ -160,6 +160,18 @@ paths:
             responses:
                 '200':
                     description: Email updated successfully
+    /api/account/update-password:
+        post:
+            summary: Update password
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: '#/components/schemas/UpdatePasswordRequest'
+            responses:
+                '200':
+                    description: Password updated successfully
     /api/upload-limit:
         get:
             summary: Get the basic file upload (POST) upload limit set by the portal
@@ -270,6 +282,16 @@ components:
                     type: string
                 password:
                     type: string
+        UpdatePasswordRequest:
+            type: object
+            required:
+                - current_password
+                - new_password
+            properties:
+                current_password:
+                    type: string
+                new_password:
+                    type: string
         PingResponse:
             type: object
             properties: