> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: A Well-Known URL for Changing Passwords
- URL: https://securinglaravel.com/security-tip-a-well-known-url-for/
- Published: 2024-03-10T08:00:55.000Z
- Updated: 2025-09-10T11:27:44.000Z
- Description: [Tip#73] You may have heard of the `/.well-known/` path, and the security.txt file, but there is a new one called `change-password` you should be aware of too!
- Author: Stephen Rees-Carter
- Tags: Security Tips, Passwords

Password managers are awesome, and they make dealing with secure passwords across hundreds of different accounts easy. They integrate with your browser, generate new passwords on registration forms, detect when you change passwords, and can even tell you when you’re using passwords that need to be changed. 

For example, here’s my [1Password Watchtower report](https://watchtower.1password.com/?ref=securinglaravel.com):

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fsubstack-post-media.s3.amazonaws.com-2fpublic-2fimages-2fed0eed1a-fa04-45e8-ae68-b8ddcd99ce7e_909x770.png)

My 1Password Watchtower, showing 3 compromised websites and 14 vulnerable passwords.

1Password will tell me when I have passwords that need changing, but in order for it to prompt me to change each password, it needs a bit of help. That’s where the “*Well-Known URL for Changing Passwords*” comes in!

[The proposal](https://github.com/w3c/webappsec-change-password-url?ref=securinglaravel.com) is very simple, just create the `/.well-known/change-password` resource on your app and redirect it to your actual password change URL.

Password managers will check the `/.well-known/change-password`, and if it returns a `2xx` or `3xx`, the password manager will send the user there to change their password. The browser will then handle the redirect, as per normal.

For example:

## The essential security resource for Laravel developers.

Sign up now to receive the [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) you need to keep your Laravel applications safe!

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.

**GitHub**

```
https://github.com/.well-known/change-password 
```

redirects to

```
https://github.com/settings/security
```

**Twitter**

```
https://twitter.com/.well-known/change-password
```

redirects to

```
https://twitter.com/settings/password
```

**Are there any security concerns by using this?**

There shouldn’t be.

Changing passwords is a expected feature, so broadcasting it’s existence isn’t an issue. Likewise, if the user isn't logged in, they should simply be redirected to the login form and then bounced to the change password form after authenticating themselves.

The only way I can see this being an issue is if the change password had a CSRF vulnerability, but if that's the case... **you've got much bigger problems.**

💡

**This isn't the point of this security tip, but if you don’t already use a password manager, then I recommend checking out* [**1Password*](https://1password.com/?ref=securinglaravel.com)**.*   
  
**I've been using (and paying for) 1Password for years, and it is worth it, and no they did not sponsor this.*

---

***If you found this security tip useful?* 👍**  
[*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.*

***Want to learn more?* 🤓**  
*Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support)*! Your support directly funds my security work in the Laravel community.* 🥰

**Need a second set of eyes on your code?** 
*Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.*

*Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*