diff --git a/Gemfile b/Gemfile
index b9e6c4f..06f6764 100644
--- a/Gemfile
+++ b/Gemfile
@@ -3,31 +3,22 @@ git_source(:github){|repo| "https://github.com/#{repo}.git"}
 
 ruby "2.4.1"
 
-gem "rails", "~> 5.2.0"
-
-gem "bootstrap-sass", "3.3.7"
-
-gem "jquery-rails", "~> 4.3", ">= 4.3.3"
-
 gem "bcrypt", "3.1.12"
-
+gem "bootsnap", ">= 1.1.0", require: false
+gem "bootstrap-sass", "3.3.7"
+gem "bootstrap-will_paginate", "1.0.0"
+gem "coffee-rails", "~> 4.2"
 gem "config"
-
-gem "sqlite3"
-
+gem "faker", "1.9.1"
+gem "jbuilder", "~> 2.5"
+gem "jquery-rails", "~> 4.3", ">= 4.3.3"
 gem "puma", "~> 3.11"
-
+gem "rails", "~> 5.2.0"
 gem "sass-rails", "~> 5.0"
-
-gem "uglifier", ">= 1.3.0"
-
-gem "coffee-rails", "~> 4.2"
-
+gem "sqlite3"
 gem "turbolinks", "~> 5"
-
-gem "jbuilder", "~> 2.5"
-
-gem "bootsnap", ">= 1.1.0", require: false
+gem "uglifier", ">= 1.3.0"
+gem "will_paginate", "3.1.6"
 
 group :development, :test do
   gem "byebug", platforms: [:mri, :mingw, :x64_mingw]
diff --git a/Gemfile.lock b/Gemfile.lock
index 0cb1f1f..03bb1f1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -53,6 +53,8 @@ GEM
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
+    bootstrap-will_paginate (1.0.0)
+      will_paginate
     builder (3.2.3)
     byebug (10.0.2)
     coffee-rails (4.2.2)
@@ -98,6 +100,8 @@ GEM
       dry-types (~> 0.13.1)
     erubi (1.7.1)
     execjs (2.7.0)
+    faker (1.9.1)
+      i18n (>= 0.7)
     ffi (1.9.25)
     globalid (0.4.1)
       activesupport (>= 4.2.0)
@@ -220,6 +224,7 @@ GEM
     websocket-driver (0.7.0)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.3)
+    will_paginate (3.1.6)
 
 PLATFORMS
   ruby
@@ -228,9 +233,11 @@ DEPENDENCIES
   bcrypt (= 3.1.12)
   bootsnap (>= 1.1.0)
   bootstrap-sass (= 3.3.7)
+  bootstrap-will_paginate (= 1.0.0)
   byebug
   coffee-rails (~> 4.2)
   config
+  faker (= 1.9.1)
   jbuilder (~> 2.5)
   jquery-rails (~> 4.3, >= 4.3.3)
   listen (>= 3.0.5, < 3.2)
@@ -245,6 +252,7 @@ DEPENDENCIES
   tzinfo-data
   uglifier (>= 1.3.0)
   web-console (>= 3.3.0)
+  will_paginate (= 3.1.6)
 
 RUBY VERSION
    ruby 2.4.1p111
diff --git a/app/assets/stylesheets/custom.scss b/app/assets/stylesheets/custom.scss
index 8fa267c..27766ac 100644
--- a/app/assets/stylesheets/custom.scss
+++ b/app/assets/stylesheets/custom.scss
@@ -174,3 +174,13 @@ input {
   width: auto;
   margin-left: 0;
 }
+
+.users {
+  list-style: none;
+  margin: 0;
+  li {
+    overflow: auto;
+    padding: 10px 0;
+    border-bottom: 1px solid $gray-lighter;
+  }
+}
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 25e8ef0..3d8a34e 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -6,7 +6,7 @@ def create
     if @user&.authenticate params[:session][:password]
       log_in @user
       remember_me
-      redirect_to @user
+      redirect_back_or @user
     else
       flash.now[:danger] = t ".error_login"
       render :new
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index bf4a682..df99185 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,4 +1,13 @@
 class UsersController < ApplicationController
+  before_action :logged_in_user, only: [:index, :edit, :update, :destroy]
+  before_action :find_user, only: [:edit, :show, :update, :destroy]
+  before_action :correct_user, only: [:edit, :update]
+  before_action :admin_user, only: :destroy
+  def index
+    @users = User.paginate page: params[:page],
+                           per_page: Settings.total_user_per_page
+  end
+
   def new
     @user = User.new
   end
@@ -14,12 +23,26 @@ def create
     end
   end
 
-  def show
-    @user = User.find_by id: params[:id]
+  def show; end
 
-    return if @user
-    flash[:danger] = t "not_found"
-    redirect_to root_path
+  def edit; end
+
+  def update
+    if @user.update_attributes user_params
+      flash[:success] = t "update_mesage"
+      redirect_to @user
+    else
+      render :edit
+    end
+  end
+
+  def destroy
+    flash[:success] = if @user.destroy
+                        t "delete_mesage_success"
+                      else
+                        t "delete_mesage_failed"
+                      end
+    redirect_to users_url
   end
 
   private
@@ -28,4 +51,28 @@ def user_params
     params.require(:user)
           .permit :name, :email, :password, :password_confirmation
   end
+
+  def logged_in_user
+    return if logged_in?
+    store_location
+    flash[:danger] = t "login_mesage"
+    redirect_to login_url
+  end
+
+  def correct_user
+    redirect_to root_path unless @user.current_user? current_user
+  end
+
+  def admin_user
+    redirect_to root_url unless current_user.admin?
+  end
+
+  def find_user
+    @user = User.find_by id: params[:id]
+
+    return if @user
+
+    flash[:danger] = t "not_found"
+    redirect_to root_path
+  end
 end
diff --git a/app/helpers/sessions_helper.rb b/app/helpers/sessions_helper.rb
index 50e3e82..b093be3 100644
--- a/app/helpers/sessions_helper.rb
+++ b/app/helpers/sessions_helper.rb
@@ -36,4 +36,13 @@ def log_out
     session.delete :user_id
     @current_user = nil
   end
+
+  def redirect_back_or default
+    redirect_to session[:forwarding_url] || default
+    session.delete :forwarding_url
+  end
+
+  def store_location
+    session[:forwarding_url] = request.original_url if request.get?
+  end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 099dd07..c2df066 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -27,6 +27,10 @@ def forget
     update_attributes remember_digest: nil
   end
 
+  def current_user? user
+    user == self
+  end
+
   class << self
     def digest string
       cost = if ActiveModel::SecurePassword.min_cost
@@ -34,7 +38,7 @@ def digest string
              else
                BCrypt::Engine.cost
              end
-      BCrypt::Password.create(string, cost: cost)
+      BCrypt::Password.create string, cost: cost
     end
 
     def new_token
diff --git a/app/views/layouts/_header.html.erb b/app/views/layouts/_header.html.erb
index b0349f6..7fcc1b1 100644
--- a/app/views/layouts/_header.html.erb
+++ b/app/views/layouts/_header.html.erb
@@ -6,7 +6,7 @@
         <li><%= link_to t(".home"), root_path %></li>
         <li><%= link_to t(".help"), help_path %></li>
         <% if logged_in? %>
-          <li><%= link_to t(".user"), "#" %></li>
+          <li><%= link_to t(".user"), users_path %></li>
           <li class="dropdown">
             <%= link_to "#", class: "dropdown-toggle",
               data: {toggle: "dropdown"} do %>
@@ -15,7 +15,7 @@
             <% end %>
             <ul class="dropdown-menu">
               <li><%= link_to t(".profile"), current_user %></li>
-              <li><%= link_to t(".settings"), "#" %></li>
+              <li><%= link_to t(".settings"), edit_user_path(current_user) %></li>
               <li class="divider"></li>
               <li>
                 <%= link_to t(".logout"), logout_path, method: :delete %>
diff --git a/app/views/users/_form.html.erb b/app/views/users/_form.html.erb
new file mode 100644
index 0000000..86465c8
--- /dev/null
+++ b/app/views/users/_form.html.erb
@@ -0,0 +1,17 @@
+<%= form_for @user do |f| %>
+  <%= render "shared/error_messages", object: @user %>
+
+  <%= f.label :name, t(".name") %>
+  <%= f.text_field :name, class: "form-control" %>
+
+  <%= f.label :email, t(".email") %>
+  <%= f.email_field :email, class: "form-control" %>
+
+  <%= f.label :password, t(".password") %>
+  <%= f.password_field :password, class: "form-control" %>
+
+  <%= f.label :password_confirmation, t(".confirmation") %>
+  <%= f.password_field :password_confirmation, class: "form-control" %>
+
+  <%= f.submit yield(:button_text), class: "btn btn-primary" %>
+<% end %>
diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb
new file mode 100644
index 0000000..5e2b99e
--- /dev/null
+++ b/app/views/users/_user.html.erb
@@ -0,0 +1,8 @@
+<li>
+  <%= gravatar_for user, size: Settings.user_picture_thumb_size %>
+  <%= link_to user.name, @user %>
+  <% if current_user.admin? && !user.current_user?(current_user) %>
+    | <%= link_to t(".delete"), user, method: :delete,
+                                      data: { confirm: t(".del_confirm") } %>
+  <% end %>
+</li>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
new file mode 100644
index 0000000..bc53532
--- /dev/null
+++ b/app/views/users/edit.html.erb
@@ -0,0 +1,13 @@
+<% provide :title, t(".title") %>
+<% provide :button_text, t(".button_text") %>
+<h1><%= t ".content" %></h1>
+<div class="row">
+  <div class="col-md-6 col-md-offset-3">
+    <%= render "form" %>
+    <div class="gravatar_edit">
+      <%= gravatar_for @user %>
+      <a href="http://gravatar.com/emails" target="_blank">
+        <%= t ".link_change" %></a>
+    </div>
+  </div>
+</div>
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
new file mode 100644
index 0000000..97a0200
--- /dev/null
+++ b/app/views/users/index.html.erb
@@ -0,0 +1,9 @@
+<% provide :title, t(".title") %>
+<h1><% t ".title" %></h1>
+<%= will_paginate %>
+
+<ul class="users">
+  <%= render @users %>
+</ul>
+
+<%= will_paginate %>
diff --git a/app/views/users/new.html.erb b/app/views/users/new.html.erb
index b9996ef..dc0122b 100644
--- a/app/views/users/new.html.erb
+++ b/app/views/users/new.html.erb
@@ -1,25 +1,8 @@
 <% provide :title, t(".sign_up") %>
+<% provide :button_text, t(".button_text") %>
 <h1><%= t ".sign_up" %></h1>
 <div class="row">
   <div class="col-md-6 col-md-offset-3">
-    <%= form_for @user, url: signup_path do |f| %>
-      <%= render "shared/error_messages" %>
-
-      <%= f.label :name, t(".name") %>
-      <%= f.text_field :name, class: "form-control" %>
-
-      <%= f.label :email, t(".email") %>
-      <%= f.email_field :email, class: "form-control" %>
-
-      <%= f.label :password, t(".password") %>
-      <%= f.password_field :password, class: "form-control" %>
-
-      <%= f.label :password_confirmation, t(".confirmation") %>
-      <%= f.password_field :password_confirmation,
-        class: "form-control" %>
-
-      <%= f.submit t(".create"),
-        class: "btn btn-primary" %>
-    <% end %>
+    <%= render "form" %>
   </div>
 </div>
diff --git a/config/locales/en.yml b/config/locales/en.yml
index b9ab1c2..d90d5c8 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2,6 +2,10 @@ en:
   back: "Back"
   en_title: "Ruby on Rails Tutorial"
   not_found: "không tìm thấy tài khoản!"
+  update_message: "Profile updated"
+  delete_mesage_success: "User deleted"
+  delete_mesage_failed: "User delete failed"
+  login_message: "Please log in."
   static_pages:
     home:
       title: "Home"
@@ -55,12 +59,24 @@ en:
     application:
   users:
     title_sample: "Welcome to the Sample App!"
+    index:
+      title: "All user"
+    user:
+      delete: "delete"
+      del_confirm: "You sure?"
     new:
       error: "error "
+      sign_up: "Sign up"
+      button_text: "Sign up"
       form_container: "The form contains "
-      sign_up: "Sign up "
       content_sigup: "This will be a signup page for new users. "
-      create: "Create my account"
+    edit:
+      title: "Edit user"
+      button_text: "Save changes"
+      content: "Update your profile"
+      link_change: "Change"
+    form:
+      create: "Comfirm"
       name: "Name"
       email: "Email"
       password: "Password"
diff --git a/config/locales/vi.yml b/config/locales/vi.yml
index 11c088d..67590b4 100644
--- a/config/locales/vi.yml
+++ b/config/locales/vi.yml
@@ -2,6 +2,13 @@ vi:
   back: "Trở lại"
   en_title: "Hướng dẫn Ruby on Rails"
   not_found: "không tìm thấy tài khoản!"
+  update_mesage: "Hồ sơ đã được cập nhật"
+  delete_mesage_success: "Người dùng đã xóa"
+  delete_mesage_failed: "Người dùng chưa được xóa"
+  login_message: "Làm ơn hay đăng nhập."
+  will_paginate:
+    next_label: "Sau"
+    previous_label: "Trước"
   activerecord:
     errors:
       models:
@@ -71,14 +78,26 @@ vi:
     application:
   users:
     title_sample: "Chào mừng đến với Ứng dụng mẫu!"
+    index:
+      title: "Tất cả người dùng"
+    user:
+      delete: "xóa"
+      del_confirm: "Bạn có chắc không ?"
     new:
       error: "lỗi "
-      form_container: "Biểu mẫu có chứa "
       sign_up: "Đăng ký"
+      button_text: "Đăng ký"
+      form_container: "Biểu mẫu có chứa "
       content_sigup: "Trang này sẽ là trang đăng ký cho 1 tài khoản mới ."
-      create: "Tạo tài khoản của tôi"
+    edit:
+      title: "Sửa người dùng"
+      button_text: "Lưu thay đổi"
+      content: "Cập nhật hồ sơ của bạn"
+      link_change: "Thay đổi"
+    form:
+      create: "Xác nhận"
       name: "Tên"
-      email: "Email"
+      email: "Thư"
       password: "Mật khẩu"
       confirmation: "Xác nhận lại mật khẩu"
   shared:
diff --git a/config/settings.yml b/config/settings.yml
index 3afac15..ea76ecb 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -2,3 +2,5 @@ name_max_length: 25
 email_max_length: 255
 password_min_length: 6
 gravatar_size : 80
+user_picture_thumb_size : 100
+total_user_per_page: 10
diff --git a/db/migrate/20180720021324_add_admin_to_users.rb b/db/migrate/20180720021324_add_admin_to_users.rb
new file mode 100644
index 0000000..aa6a7e9
--- /dev/null
+++ b/db/migrate/20180720021324_add_admin_to_users.rb
@@ -0,0 +1,5 @@
+class AddAdminToUsers < ActiveRecord::Migration[5.2]
+  def change
+    add_column :users, :admin, :boolean, default: false
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 87263bd..26687bc 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2018_07_17_071719) do
+ActiveRecord::Schema.define(version: 2018_07_20_021324) do
 
   create_table "users", force: :cascade do |t|
     t.string "name"
@@ -19,6 +19,7 @@
     t.datetime "updated_at", null: false
     t.string "password_digest"
     t.string "remember_digest"
+    t.boolean "admin", default: false
     t.index ["email"], name: "index_users_on_email", unique: true
   end
 
diff --git a/db/seeds.rb b/db/seeds.rb
new file mode 100644
index 0000000..6c43df1
--- /dev/null
+++ b/db/seeds.rb
@@ -0,0 +1,15 @@
+User.create!(name: "Example User",
+             email: "example@railstutorial.org",
+             password: "foobar",
+             password_confirmation: "foobar",
+             admin: true)
+
+99.times do |n|
+  name  = Faker::Name.name
+  email = "example-#{n+1}@railstutorial.org"
+  password = "password"
+  User.create!(name:  name,
+               email: email,
+               password: password,
+               password_confirmation: password)
+end