› › ›

Change passwords API

Changes the passwords of users in the native realm and built-in users.

Request

POST /_security/user/_password

POST /_security/user/<username>/_password

Prerequisites

Every user can change their own password. Users with the manage_security privilege can change passwords of other users.

Description

You can use the create user API to update everything but a user’s username and password. This API changes a user’s password.

For more information about the native realm, see Realms and Native user authentication.

Path parameters

username: (Optional, string) The user whose password you want to change. If you do not specify this parameter, the password is changed for the current user.

Request body

password

(string) The new password value. Passwords must be at least 6 characters long.

One of password or password_hash is required.

password_hash

(string) A hash of the new password value. This must be produced using the same hashing algorithm as has been configured for password storage. For more details, see the explanation of the xpack.security.authc.password_hashing.algorithm setting in User cache and password hash algorithms.

Using this parameter allows the client to pre-hash the password for performance and/or confidentiality reasons.

The password parameter and the password_hash parameter cannot be used in the same request.

Examples

The following example updates the password for the jacknich user:

resp = client.security.change_password(
    username="jacknich",
    password="new-test-password",
)
print(resp)

const response = await client.security.changePassword({
  username: "jacknich",
  password: "new-test-password",
});
console.log(response);

POST /_security/user/jacknich/_password
{
  "password" : "new-test-password"
}

A successful call returns an empty JSON structure.

{}

© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/security-api-change-password.html