---
type: api
title: Change passwords
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-change-password
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-change-password
products:
  - Elasticsearch
---

# Change passwords


## Paths

- `POST` (also `PUT`) `/_security/user/{username}/_password`
- `POST` (also `PUT`) `/_security/user/_password`

#### Path parameters

- `username` (string) — optional, leave it out to use `/_security/user/_password`
  The user whose password you want to change. If you do not specify this
parameter, the password is changed for the current user.

## Description

Change the passwords of users in the native realm and built-in users.

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)

## Query string parameters

- `refresh` (enum) — optional
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Request body

`application/json`

- `password` (string) — optional
  The new password value. Passwords must be at least 6 characters long.
- `password_hash` (string) — optional
  A hash of the new password value. This must be produced using the same
hashing algorithm as has been configured for password storage. For more details,
see the explanation of the `xpack.security.authc.password_hashing.algorithm`
setting.

## Response

`application/json`

Type: `object`

## Code examples

#### Console

```console
POST /_security/user/jacknich/_password
{
  "password" : "new-test-password"
}
```

#### JavaScript

```javascript
const response = await client.security.changePassword({
  username: "jacknich",
  password: "new-test-password",
});
```

#### Python

```python
resp = client.security.change_password(
    username="jacknich",
    password="new-test-password",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/user/jacknich/_password" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "new-test-password"
  }'
```

#### Java

```java
client.security().changePassword(c -> c
    .password("new-test-password")
    .username("jacknich")
);
```

#### C#

```c#
var response = await client.Security
    .ChangePasswordAsync(d1 => d1
        .Username("jacknich")
        .Password("new-test-password")
    );
```

#### PHP

```php
$resp = $client->security()->changePassword([
    "username" => "jacknich",
    "body" => [
        "password" => "new-test-password",
    ],
]);
```

#### Ruby

```ruby
response = client.security.change_password(
  username: "jacknich",
  body: {
    "password": "new-test-password"
  }
)
```