---
title: Help password managers find your change password page
url: https://calvin.my/posts/help-password-managers-find-your-change-password-page
published: 2026-09-16
updated: 2026-09-16
category: Development
tags:
- Rails
- Security
- Password
summary: The post explains how Rails apps can help browsers and password managers locate password-change forms through a standardized well-known URL. The endpoint must exist at the site root and temporarily redirect to the actual password-change page rather than serving it directly. Other unknown well-known paths should not appear successful. A routing redirect implements this, while password-field autocomplete hints can improve support for automated password changes. Signed-out users may appropriately be redirected to login.
---

# Help password managers find your change password page

Browsers and password managers (such as Google Password Manager) have a "Change password" button, and they need to know where your change password form lives. The well-known change-password URL answers that. 
This article documents the steps to add it to a Rails app,

* * *

## The rules
1. The path is fixed: `/.well-known/change-password` at the root of your origin.
2. Respond with a temporary redirect (302, 303, or 307) to the real page. Do not serve the page at the well-known URL itself.

   Reference: https://w3c.github.io/webappsec-change-password-url/#semantics

   ```markup
   GET /.well-known/change-password HTTP/1.1
   Host: example.com
   
   HTTP/1.1 303 See Other
   Location: https://example.com/profile/edit#change-password
   ```

3. Unknown well-known paths must not return a success status. If a 2xx returns (after following redirects), your server is treated as unreliable.

* * *

## The implementation
1. Add a routing-level redirect with an explicit status:

   ```ruby
   # config/routes.rb
   Rails.application.routes.draw do
     get "/.well-known/change-password",
         to: redirect("/profile/edit#change-password", status: 303)
   end
   ```
2. (Optional) For a password manager that performs automatic password change, add a `autocomplete` hint to the password field.
   ```erb
   <div id="change-password">
   	...
       <%= form_with model: @user, url: profile_path, method: :patch do |form| %>
       <%= form.password_field :current_password, autocomplete: "current-password" %>
       <%= form.password_field :password, autocomplete: "new-password" %>
       <%= form.password_field :password_confirmation, autocomplete: "new-password" %>
       <%= form.submit "Update Password" %>
     <% end %>
   </div>
   ```
   Reference: https://developer.chrome.com/docs/identity/automated-password-change

* * *

## Notes
Signed-out users should land on your login page. This is expected.