Purpose
Provides authenticated users with the ability to update their password while maintaining account security.
Quick Summary
- Users must know their current password.
- New passwords must meet password requirements.
- Password confirmation is required.
- Users may only change their own password.
Workflow
Password Requirements
The new password must:
- Be different from the current password
- Meet platform password requirements
- Match the confirmation field
Real-World Example
Sarah logs into the Creditor Portal and wants to update her password.
She:
- Enters her current password
- Enters a new password
- Confirms the new password
- Saves changes
The system validates the request and updates her credentials.
How It Should Work
- Require current password validation.
- Require password confirmation.
- Enforce password complexity rules.
- Update only the logged-in user’s password.
- Allow continued use of the application after a successful change.
How It Should Not Work
- Allow password changes without the current password.
- Accept weak passwords.
- Accept mismatched confirmation values.
- Change another user’s password.
Developer Notes
- Password changes must be scoped to the authenticated user.
- Password history and security rules should be enforced consistently.
- Authentication state must remain secure throughout the process.
Last modified on June 1, 2026
