# IRPCLogin.ChangePassword

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Vault API](https://developer.m-files.com/APIs/gRPC-API/vault/index.md) > [Login and sessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/ChangePassword/

Badges: `Vault API / core` `session` `session`

Changes the M-Files password of the logged-in account.

- **Service:** [Login and sessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/index.md) `MFiles.IRPCLogin`
- **gRPC method:** `/MFiles.IRPCLogin/ChangePassword`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/change-password`
- **Request:** [`ChangePasswordRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/ChangePassword/index.md#request)
- **Response:** [`ChangePasswordResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/ChangePassword/index.md#response)
- **Book and level:** Vault API, core
- **Kind:** session
- **Session:** Required: the session ID from LogIn in the mfiles-session-id-bin metadata.
- **Idempotent:** no
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

Failed attempts count towards the server's login attack protection, like failed logins.

Always set `password_format` to `PASSWORD_FORMAT_SEE_OTHER_PARAMS` and `passwords_unhashed` to
true: the proto3 default of `password_format` selects a deprecated format.

After the change the server logs the account out of all vaults on the server, so expect to log in
again with the new password.

<a id="request"></a>

## Request: ChangePasswordRequest

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `old_password` | `string` | The current password, in the form `password_format`, `password_encryption` and `passwords_unhashed` describe. |
| `new_password` | `string` | The new password, in the same form as `old_password`. |
| `password_format` | [`PasswordFormat`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordFormat/index.md) | Set to `PASSWORD_FORMAT_SEE_OTHER_PARAMS`. The other values are deprecated and override `password_encryption`, `passwords_unhashed` and `password_hash_algorithm_desired`. Values: `PASSWORD_FORMAT_MD5_HASH_ENCRYPTED` (0), `PASSWORD_FORMAT_PLAIN_TEXT` (1), `PASSWORD_FORMAT_SEE_OTHER_PARAMS` (2). |
| `password_encryption` | [`PasswordEncryption`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordEncryption/index.md) | How the passwords are encrypted in transit. Values: `PASSWORD_ENCRYPTION_RC4` (0), `PASSWORD_ENCRYPTION_UNENCRYPTED` (1), `PASSWORD_ENCRYPTION_AES256` (2). |
| `passwords_unhashed` | `bool` | Set to true and send the passwords as entered. Pre-hashed passwords are accepted only with MD5. |
| `password_hash_algorithm_desired` | [`PasswordHashAlgorithm`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.PasswordHashAlgorithm/index.md) | The algorithm the server uses to store the new password. Values: `PASSWORD_HASH_ALGORITHM_MD5` (0), `PASSWORD_HASH_ALGORITHM_UNDEFINED` (1), `PASSWORD_HASH_ALGORITHM_PBKDF2_WITH_SHA512_AND100000_ITERS` (2). |

<a id="response"></a>

## Response: ChangePasswordResponse

No fields.