Who this is for. The theme developer building the change-password screen, and whoever answers "I changed my password, why am I still signed in on my phone?" (they are not, and this page says why).
The form
users/change-password.html, which you write, posts to /change-password as a PUT, with the CSRF token. The route is for signed-in members only, and the Users setting Change Password, on by default, switches it off with a 404. It takes three fields, and a failure re-renders the form with HTTP 422 and the message on the field named:
| Field | Rule | Message, and the field it is on |
|---|---|---|
currentPassword | Must match the member's password | "Does not match your current password", on currentPassword |
password | At least the minimum length, the Users setting Minimum password length, six characters by default | "Password must have at least 6 characters", on password |
confirmPassword | Must equal password, and must not be empty | "The passwords do not match", on password; "The confirm password may not be empty", on confirmPassword |
Send all three every time: the length and match rules run only when confirmPassword is in the request. On success the page redirects back to itself with "Your Password Has Been Changed". How the account forms post has the form with its error output.
The minimum length is the only rule: there is no requirement for digits, symbols or mixed case. Raise the minimum on any site with member accounts; ten characters or more is a reasonable floor, and length does more for strength than character rules do. Say what the rule is next to the field, so members do not learn it from an error.
Why the current password is required
A signed-in session is not proof that the person at the keyboard is the member: a browser left signed in on a shared computer, or a session taken over some other way, would otherwise let someone lock the member out of their own account. Asking for the current password makes the change something only the member can do. The reset page is the one place that does not ask, because the emailed link has already proved who the member is (Setting the new password).
What happens to other sessions
When the password changes, here or through a reset, the member's other signed-in sessions end, apart from a device kept signed in with Remember me: on their phone, in another browser, on another computer. The session that made the change continues, so the member is not signed out of the page they are on.
That is usually what a member wants after a change, and what teams forget to tell them. Say it on the success message, for example "Your password has been changed. You have been signed out on your other devices.", so a member who sees the sign-in page on their phone later knows why. A member who wants to end the other sessions without changing the password can do it from their list of signed-in sessions (Signed-in sessions).
A member who signs in only with a provider or a passkey has no password to change. They can set one through the reset flow, or by adding password sign-in on the linked-accounts screen (The linked-accounts screen).