# Setting an account's password

> Gives an existing account of your app a new password, and signs out everything that was signed in with the old one. Use it when a password leaked, was forgotten, or belongs to a service account you rotate.

<!-- id: local-setting-an-accounts-password · area: local · stability: stable · html: https://osysharp.com/reference/local/setting-an-accounts-password/ -->

## Summary        {#summary}

Sets a new password on an account your app already has, the one a sign-in with that login finds. The password is
hashed the same way your app's sign-in checks it. When the change is saved, everything signed in with the old password
stops working.

The remote twin is `osyrin app user set-password`. It does the same thing, with the same flags, to an app on a
platform you are signed in to.

## Signature      {#signature}

```console
osy user set-password <login> [path] [--password-file <path> | --password-stdin] [--devname <name>]
osyrin app user set-password <login> [--app <app>] [--password-file <path> | --password-stdin]
```

## Description    {#description}

### Giving it the password   {#password}

There is **no `--password <value>`**. You usually change a password because the old one got out. A value on the
command line sits in the process list, where any user of the machine can read it while the command runs. So the new
password comes in one of three ways:

- **typed at the prompt**, which does not echo (the default when you pass neither flag);
- **`--password-file <path>`**: a file only you can read. If anyone else can read it, the command refuses before it
  contacts anything, and names the `chmod 600` that fixes it;
- **`--password-stdin`**: piped in.

One trailing line break is dropped. The command never prints the password.

```console
$ osy user set-password ops@example.com --password-file ~/.ops-pw
✓ Set a new password for ops@example.com. Ended 2 signed-in sessions — the old password and anything signed in
  with it no longer work. API keys are separate: `user apikey revoke`.
```

### What stops working   {#what-ends}

Once the new password is saved:

- **the old password** no longer signs in;
- **every signed-in session** of the account in this app is refused on its next request, on every server. The person
  is told *"You were signed out because this account's password was changed or reset in another session."*;
- **every client the account connected through MCP sign-in** loses its refresh token and has to be connected again.

**API keys are not touched.** A key is a separate credential, and having the password does not let anyone mint one.
If a key may have leaked too, retire it with `osy user apikey revoke` (or `osyrin app user apikey revoke`).

### Who may do it   {#who}

The same people who may add an account: on your local platform, you; on Osyrin Cloud, an Owner of the app (or an
admin of its organization). If you could choose a new account's password, you can also choose a new password for an
existing account. Nobody below that level can do either. A Developer, who can read the app's accounts, is refused.

### An account that does not exist   {#missing}

The command refuses and writes nothing. It never creates the account:

```console
$ osy user set-password nobody@example.com --password-file ~/.pw
✗ no account 'nobody@example.com' in this application — `osyrin app user list` shows who it has; `app user add` makes one
```

## Examples       {#examples}

```console
osy user set-password me@example.com                                # prompt for the new password
osy user set-password svc@example.com --password-file ~/.svc-pw     # unattended: a 0600 file, never argv
pwgen-cmd | osy user set-password svc@example.com --password-stdin  # piped
osyrin app user set-password ops@example.com --app acme --password-file ~/.ops-pw   # an app on Osyrin Cloud
```

## See also       {#see-also}

[Adding an account](https://osysharp.com/reference/local/adding-an-account/): makes the account in the first place, with the same password flags.

[app.Auth — how the platform authenticates a user of your app](https://osysharp.com/reference/security/password-auth/): the declaration both commands read, which names the login and password fields.