# Validate password for users that are logged in via frontend

**URL:** <https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461>\
**Category:** Questions\
**Tags:** v3\
**Created:** [April 26, 2023, 10:11pm UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461 "2023-04-26T22:11:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![steenweg](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@steenweg](https://forum.getkirby.com/u/steenweg)\
**Post date:** [April 26, 2023, 10:11pm UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/1 "2023-04-26T22:11:19Z")

</div>

In a project with frontend user login, I need the possibility for logged-in users to change their password. For security reasons, they should enter their current password and then the desired new password with repetition. Some years ago I implemented something like that with Kirby 2:

```auto
// get the old/existing password from form input
$old_pw = get('oldPW');
// get the new password
$new_pw = get('newPW');
// get the new password confirmation
$new_pw_confirm = get('newPWconfirm');
// get old/existing password from site
$hash = $site->user()->current()->data()['password'];
// check if old password is correct and if new password fits
if ((password::match($old_pw, $hash)) AND ($new_pw == $new_pw_confirm))
// do something...

```

In Kirby 3 I get the hash of the current password with

`$site->user()->password()`

But how do I change the last query `(password::match)` so that it works under Kirby 3? `auth->login()` doesn’t seem to be the appropriate method.

---

<div class="post-metadata">

**Author:** ![steenweg](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@steenweg](https://forum.getkirby.com/u/steenweg)\
**Post date:** [April 27, 2023, 11:20am UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/2 "2023-04-27T11:20:06Z")

</div>

Does no one have any idea? I almost can’t imagine that I am the first one to have this problem. I’ve been searching the forum all morning and trying things out.

TIA, every hint helps!

---

<div class="post-metadata">

**Author:** ![rasteiner](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/rasteiner/32/4788_2.png) [@rasteiner](https://forum.getkirby.com/u/rasteiner)\
**Post date:** [April 27, 2023, 11:22am UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/3 "2023-04-27T11:22:56Z")

</div>

You could use `$kirby->user()->validatePassword($old_pw)` instead. No need to manually retrieve the old password.

See

> **[$user-\>validatePassword()](https://getkirby.com/docs/reference/objects/cms/user/validate-password)**
>
> Compares the given password with the stored one

---

<div class="post-metadata">

**Author:** ![steenweg](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@steenweg](https://forum.getkirby.com/u/steenweg)\
**Post date:** [April 27, 2023, 11:26am UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/4 "2023-04-27T11:26:36Z")

</div>

Thank you so much! Obviously I was so caught up in the old thinking pattern that I completely overlooked this obvious solution.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [April 27, 2023, 11:26am UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/5 "2023-04-27T11:26:45Z")

</div>

Note that you have to use `$kirby->user()`, not `$site->user()`in Kirby 3!

---

<div class="post-metadata">

**Author:** ![steenweg](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@steenweg](https://forum.getkirby.com/u/steenweg)\
**Post date:** [April 27, 2023, 11:28am UTC](https://forum.getkirby.com/t/validate-password-for-users-that-are-logged-in-via-frontend/28461/6 "2023-04-27T11:28:37Z")

</div>

Sure, thank you Sonja! Fixed that already in other places of the old code.