diff --git a/backend/routes.js b/backend/routes.js
index 97136c1d8..b61a06c8a 100644
--- a/backend/routes.js
+++ b/backend/routes.js
@@ -9,7 +9,7 @@ import { SERVER_INSTANCE } from './instance-keys.js'
 import path from 'path'
 import chalk from 'chalk'
 import './database.js'
-import { registrationKey, register, getChallenge, getContractSalt, updateContractSalt } from './zkppSalt.js'
+import { registrationKey, register, getChallenge, getContractSalt, updateContractSalt, redeemSaltUpdateToken } from './zkppSalt.js'
 import Bottleneck from 'bottleneck'
 
 const MEGABYTE = 1048576 // TODO: add settings for these
@@ -116,7 +116,24 @@ route.POST('/event', {
           }
         }
       }
+      const saltUpdateToken = request.headers['shelter-salt-update-token']
+      let updateSalts
+      if (saltUpdateToken) {
+        // If we've got a salt update token (i.e., a password change), fetch
+        // the username associated to the contract to see if they match, and
+        // then validate the token
+        const name = request.headers['shelter-name']
+        const namedContractID = name && await sbp('backend/db/lookupName', name)
+        if (namedContractID !== deserializedHEAD.contractID) {
+          throw new Error('Mismatched contract ID and name')
+        }
+        updateSalts = await redeemSaltUpdateToken(name, saltUpdateToken)
+      }
       await sbp('backend/server/handleEntry', deserializedHEAD, request.payload)
+      // If it's a salt update, do it now after handling the message. This way
+      // we make it less likely that someone will end up locked out from their
+      // identity contract.
+      await updateSalts?.(deserializedHEAD.hash)
       if (deserializedHEAD.isFirstMessage) {
         // Store attribution information
         if (credentials?.billableContractID) {
@@ -821,7 +838,7 @@ route.GET('/zkpp/{name}/contract_hash', {
   return Boom.internal('internal error')
 })
 
-route.POST('/zkpp/updatePasswordHash/{name}', {
+route.POST('/zkpp/{name}/updatePasswordHash', {
   validate: {
     payload: Joi.object({
       r: Joi.string().required(),
@@ -841,7 +858,7 @@ route.POST('/zkpp/updatePasswordHash/{name}', {
     }
   } catch (e) {
     e.ip = req.headers['x-real-ip'] || req.info.remoteAddress
-    console.error(e, 'Error at POST /zkpp/updatePasswordHash/{name}: ' + e.message)
+    console.error(e, 'Error at POST /zkpp/{name}/updatePasswordHash: ' + e.message)
   }
 
   return Boom.internal('internal error')
diff --git a/backend/zkppSalt.js b/backend/zkppSalt.js
index 63794a907..96f49770d 100644
--- a/backend/zkppSalt.js
+++ b/backend/zkppSalt.js
@@ -1,7 +1,8 @@
 import sbp from '@sbp/sbp'
 import { randomBytes, timingSafeEqual } from 'crypto'
 import nacl from 'tweetnacl'
-import { base64ToBase64url, base64urlToBase64, boxKeyPair, computeCAndHc, encryptContractSalt, hash, hashRawStringArray, hashStringArray, parseRegisterSalt, randomNonce } from '~/shared/zkpp.js'
+import { base64ToBase64url, base64urlToBase64, boxKeyPair, computeCAndHc, decryptSaltUpdate, encryptContractSalt, encryptSaltUpdate, hash, hashRawStringArray, hashStringArray, parseRegisterSalt, randomNonce } from '~/shared/zkpp.js'
+import { AUTHSALT, CONTRACTSALT, SALT_LENGTH_IN_OCTETS, SU } from '~/shared/zkppConstants.js'
 
 // used to encrypt salts in database
 let recordSecret: string
@@ -9,6 +10,8 @@ let recordSecret: string
 let challengeSecret: string
 // corresponds to a component of s in Step 3 of "Salt registration"
 let registrationSecret: string
+// used to encrypt a stateless token for atomic hash updates
+let hashUpdateSecret: string
 
 // Input keying material used to derive various secret keys used in this
 // protocol: recordSecret, challengeSecret and registrationSecret.
@@ -60,10 +63,23 @@ export const initZkpp = async () => {
   recordSecret = Buffer.from(hashStringArray('private/recordSecret', IKM)).toString('base64')
   challengeSecret = Buffer.from(hashStringArray('private/challengeSecret', IKM)).toString('base64')
   registrationSecret = Buffer.from(hashStringArray('private/registrationSecret', IKM)).toString('base64')
+  hashUpdateSecret = Buffer.from(hashStringArray('private/hashUpdateSecret', IKM)).toString('base64')
 }
 
 const maxAge = 30
 
+const computeZkppSaltRecordId = async (contractID: string) => {
+  const recordId = `_private_rid_${contractID}`
+  const record = await sbp('chelonia/db/get', recordId)
+
+  if (!record) {
+    return null
+  }
+
+  const recordBuf = Buffer.concat([Buffer.from(contractID), Buffer.from(record)])
+  return hash(recordBuf)
+}
+
 const getZkppSaltRecord = async (contractID: string) => {
   const recordId = `_private_rid_${contractID}`
   const record = await sbp('chelonia/db/get', recordId)
@@ -85,17 +101,23 @@ const getZkppSaltRecord = async (contractID: string) => {
     try {
       const recordObj = JSON.parse(recordString)
 
-      if (!Array.isArray(recordObj) || recordObj.length !== 3 || !recordObj.reduce((acc, cv) => acc && typeof cv === 'string', true)) {
+      if (
+        !Array.isArray(recordObj) ||
+        (recordObj.length !== 3 && recordObj.length !== 4) ||
+        recordObj.slice(0, 3).some((r) => !r || typeof r !== 'string') ||
+        (recordObj[3] !== null && typeof recordObj[3] !== 'string')
+      ) {
         console.error('Error validating encrypted JSON object ' + recordId)
         return null
       }
 
-      const [hashedPassword, authSalt, contractSalt] = recordObj
+      const [hashedPassword, authSalt, contractSalt, cid] = recordObj
 
       return {
         hashedPassword,
         authSalt,
-        contractSalt
+        contractSalt,
+        cid
       }
     } catch {
       console.error('Error parsing encrypted JSON object ' + recordId)
@@ -105,11 +127,11 @@ const getZkppSaltRecord = async (contractID: string) => {
   return null
 }
 
-const setZkppSaltRecord = async (contractID: string, hashedPassword: string, authSalt: string, contractSalt: string) => {
+const setZkppSaltRecord = async (contractID: string, hashedPassword: string, authSalt: string, contractSalt: string, cid: ?string) => {
   const recordId = `_private_rid_${contractID}`
   const encryptionKey = hashStringArray('REK', contractID, recordSecret).slice(0, nacl.secretbox.keyLength)
   const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
-  const recordPlaintext = JSON.stringify([hashedPassword, authSalt, contractSalt])
+  const recordPlaintext = JSON.stringify([hashedPassword, authSalt, contractSalt, cid])
   const recordCiphertext = nacl.secretbox(Buffer.from(recordPlaintext), nonce, encryptionKey)
   const recordBuf = Buffer.concat([nonce, recordCiphertext])
   const record = base64ToBase64url(recordBuf.toString('base64'))
@@ -242,7 +264,7 @@ export const getContractSalt = async (contract: string, r: string, s: string, si
     return false
   }
 
-  const { hashedPassword, contractSalt } = record
+  const { hashedPassword, contractSalt, cid } = record
 
   const c = contractSaltVerifyC(hashedPassword, r, s, hc)
 
@@ -251,10 +273,10 @@ export const getContractSalt = async (contract: string, r: string, s: string, si
     throw new Error('getContractSalt: Bad challenge')
   }
 
-  return encryptContractSalt(c, contractSalt)
+  return encryptContractSalt(c, JSON.stringify([contractSalt, cid]))
 }
 
-export const updateContractSalt = async (contract: string, r: string, s: string, sig: string, hc: string, encryptedArgs: string): Promise<boolean> => {
+export const updateContractSalt = async (contract: string, r: string, s: string, sig: string, hc: string, encryptedArgs: string): Promise<boolean | string> => {
   if (!verifyChallenge(contract, r, s, sig)) {
     console.warn('update: Error validating challenge: ' + JSON.stringify({ contract, r, s, sig }))
     throw new Error('update: Bad challenge')
@@ -266,7 +288,7 @@ export const updateContractSalt = async (contract: string, r: string, s: string,
     console.error('update: Error obtaining ZKPP salt record for contract ID ' + contract)
     return false
   }
-  const { hashedPassword } = record
+  const { hashedPassword, contractSalt: oldContractSalt } = record
 
   const c = contractSaltVerifyC(hashedPassword, r, s, hc)
 
@@ -275,7 +297,7 @@ export const updateContractSalt = async (contract: string, r: string, s: string,
     throw new Error('update: Bad challenge')
   }
 
-  const encryptionKey = hashRawStringArray('SU', c).slice(0, nacl.secretbox.keyLength)
+  const encryptionKey = hashRawStringArray(SU, c).slice(0, nacl.secretbox.keyLength)
   const encryptedArgsBuf = Buffer.from(base64urlToBase64(encryptedArgs), 'base64')
   const nonce = encryptedArgsBuf.slice(0, nacl.secretbox.nonceLength)
   const encryptedArgsCiphertext = encryptedArgsBuf.slice(nacl.secretbox.nonceLength)
@@ -288,21 +310,50 @@ export const updateContractSalt = async (contract: string, r: string, s: string,
   }
 
   try {
-    const argsObj = JSON.parse(Buffer.from(args).toString())
+    const hashedPassword = Buffer.from(args).toString()
 
-    if (!Array.isArray(argsObj) || argsObj.length !== 3 || !argsObj.reduce((acc, cv) => acc && typeof cv === 'string', true)) {
-      console.error(`update: Error validating the encrypted arguments for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+    const recordId = await computeZkppSaltRecordId(contract)
+    if (!recordId) {
+      console.error(`update: Error obtaining record ID for contract ID ${contract}`)
       return false
     }
 
-    const [hashedPassword, authSalt, contractSalt] = argsObj
+    const authSalt = Buffer.from(hashStringArray(AUTHSALT, c)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
+    const contractSalt = Buffer.from(hashStringArray(CONTRACTSALT, c)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
 
-    await setZkppSaltRecord(contract, hashedPassword, authSalt, contractSalt)
+    const token = encryptSaltUpdate(
+      hashUpdateSecret,
+      recordId,
+      JSON.stringify([Date.now(), hashedPassword, authSalt, contractSalt])
+    )
 
-    return true
+    return encryptContractSalt(c, JSON.stringify([oldContractSalt, token]))
   } catch {
     console.error(`update: Error parsing encrypted arguments for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
   }
 
   return false
 }
+
+export const redeemSaltUpdateToken = async (contract: string, token: string): Promise<(cid: ?string) => Promise<void>> => {
+  const recordId = await computeZkppSaltRecordId(contract)
+  if (!recordId) {
+    throw new Error('Record ID not found')
+  }
+
+  const decryptedToken = decryptSaltUpdate(
+    hashUpdateSecret,
+    recordId,
+    token
+  )
+
+  const [timestamp, hashedPassword, authSalt, contractSalt] = JSON.parse(decryptedToken)
+
+  if (timestamp < (Date.now() - 180e3)) {
+    throw new Error('ZKPP token expired')
+  }
+
+  return (cid: ?string) => {
+    return setZkppSaltRecord(contract, hashedPassword, authSalt, contractSalt, cid)
+  }
+}
diff --git a/backend/zkppSalt.test.js b/backend/zkppSalt.test.js
index 7592b4d30..840820dc8 100644
--- a/backend/zkppSalt.test.js
+++ b/backend/zkppSalt.test.js
@@ -5,13 +5,14 @@ import should from 'should'
 import initDB from './database.js'
 import 'should-sinon'
 
+import { AUTHSALT, CONTRACTSALT, CS, SALT_LENGTH_IN_OCTETS, SU } from '~/shared/zkppConstants.js'
 import { registrationKey, register, getChallenge, getContractSalt, updateContractSalt } from './zkppSalt.js'
 
 const saltsAndEncryptedHashedPassword = (p: string, secretKey: Uint8Array, hash: string) => {
   const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
   const dhKey = nacl.hash(nacl.box.before(Buffer.from(p, 'base64url'), secretKey))
-  const authSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from('AUTHSALT')), dhKey]))).slice(0, 18).toString('base64')
-  const contractSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from('CONTRACTSALT')), dhKey]))).slice(0, 18).toString('base64')
+  const authSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from(AUTHSALT)), dhKey]))).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
+  const contractSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from(CONTRACTSALT)), dhKey]))).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
   const encryptionKey = nacl.hash(Buffer.from(authSalt + contractSalt)).slice(0, nacl.secretbox.keyLength)
   const encryptedHashedPassword = Buffer.concat([nonce, nacl.secretbox(Buffer.from(hash), nonce, encryptionKey)]).toString('base64url')
 
@@ -75,8 +76,10 @@ describe('ZKPP Salt functions', () => {
 
     const saltBuf = Buffer.from(salt, 'base64url')
     const nonce = saltBuf.slice(0, nacl.secretbox.nonceLength)
-    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from('CS'), c])).slice(0, nacl.secretbox.keyLength)
-    const retrievedContractSalt = Buffer.from(nacl.secretbox.open(saltBuf.slice(nacl.secretbox.nonceLength), nonce, encryptionKey)).toString()
+    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from(CS), c])).slice(0, nacl.secretbox.keyLength)
+    const [retrievedContractSalt] = JSON.parse(
+      Buffer.from(nacl.secretbox.open(saltBuf.slice(nacl.secretbox.nonceLength), nonce, encryptionKey)).toString()
+    )
     should(retrievedContractSalt).equal(contractSalt, 'mismatched contractSalt')
   })
 
@@ -103,7 +106,7 @@ describe('ZKPP Salt functions', () => {
     const c = nacl.hash(Buffer.concat([nacl.hash(Buffer.from(hash)), nacl.hash(ħ)]))
     const hc = nacl.hash(c)
 
-    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from('SU'), c])).slice(0, nacl.secretbox.keyLength)
+    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from(SU), c])).slice(0, nacl.secretbox.keyLength)
     const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
 
     const encryptedArgsCiphertext = nacl.secretbox(Buffer.from(JSON.stringify(['a', 'b', 'c'])), nonce, encryptionKey)
@@ -111,6 +114,6 @@ describe('ZKPP Salt functions', () => {
     const encryptedArgs = Buffer.concat([nonce, encryptedArgsCiphertext]).toString('base64url')
 
     const updateRes = await updateContractSalt(contract, r, challenge.s, challenge.sig, Buffer.from(hc).toString('base64url'), encryptedArgs)
-    should(updateRes).equal(true, 'updateContractSalt should be successful')
+    should(!!updateRes).equal(true, 'updateContractSalt should be successful')
   })
 })
diff --git a/frontend/controller/actions/identity.js b/frontend/controller/actions/identity.js
index 723a4b256..92dc8ef23 100644
--- a/frontend/controller/actions/identity.js
+++ b/frontend/controller/actions/identity.js
@@ -14,17 +14,168 @@ import { SETTING_CURRENT_USER } from '~/frontend/model/database.js'
 import { JOINED_CHATROOM, KV_QUEUE, LOGIN, LOGOUT } from '~/frontend/utils/events.js'
 import { GIMessage } from '~/shared/domains/chelonia/GIMessage.js'
 import { Secret } from '~/shared/domains/chelonia/Secret.js'
-import { encryptedOutgoingData, encryptedOutgoingDataWithRawKey } from '~/shared/domains/chelonia/encryptedData.js'
+import { encryptedIncomingDataWithRawKey, encryptedOutgoingData, encryptedOutgoingDataWithRawKey } from '~/shared/domains/chelonia/encryptedData.js'
+import { rawSignedIncomingData } from '~/shared/domains/chelonia/signedData.js'
 import { EVENT_HANDLED } from '~/shared/domains/chelonia/events.js'
+import { findKeyIdByName } from '~/shared/domains/chelonia/utils.js'
 // Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
 import type { Key } from '../../../shared/domains/chelonia/crypto.js'
 import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, deserializeKey, keyId, keygen, serializeKey } from '../../../shared/domains/chelonia/crypto.js'
+import { handleFetchResult } from '../utils/misc.js'
 import { encryptedAction, groupContractsByType, syncContractsInOrder } from './utils.js'
 
+/**
+ * Decrypts the old IEK list using the provided contract ID and IEK.
+ *
+ * @param contractID - The ID of the contract.
+ * @param IEK - The encryption key object.
+ * @param encryptedData - The encrypted data string, or null if not available.
+ * @returns The decrypted old IEK list, or an empty array if decryption fails.
+ */
+const decryptOldIekList = (contractID: string, IEK: Key, encryptedData: ?string) => {
+  // Return an empty array if no encrypted data is provided
+  if (!encryptedData) return []
+
+  try {
+    // Parse the encrypted data from JSON format
+    const parsedData = JSON.parse(encryptedData)
+
+    // Decrypt the incoming data using the IEK and contract ID
+    const decryptedData = encryptedIncomingDataWithRawKey(IEK, parsedData, `meta.private.oldKeys;${contractID}`)
+
+    // Parse the decrypted data back into a JavaScript object
+    const oldKeysList = JSON.parse(decryptedData.valueOf())
+
+    return oldKeysList // Return the decrypted old keys
+  } catch (error) {
+    // Log any errors that occur during decryption
+    console.error('[decryptOldIekList] Error during decryption', error)
+  }
+
+  // Don't return in case of error
+}
+
+/**
+ * Decrypts the old IEK list using the provided contract ID and IEK.
+ *
+ * @param identityContractID - The identity contract ID
+ * @param oldKeysAnchorCid - The CID corresponding to the password change message
+ * @param IEK - The encryption key object.
+ * @returns The decrypted old IEK list, or an empty array if decryption fails.
+ */
+const processOldIekList = async (identityContractID: string, oldKeysAnchorCid: string, IEK: Key) => {
+  try {
+    // Fetch the old keys from the server
+    const result = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/file/${oldKeysAnchorCid}`).then(handleFetchResult('json'))
+
+    // Parse the signed data in the OP_KEY_UPDATE payload to extract keys
+    const oldKeys = (() => {
+      const data = rawSignedIncomingData(result)
+      const head = JSON.parse(data.get('head'))
+      if (head.contractID !== identityContractID) {
+        throw new Error('Unexpected contract ID.')
+      }
+      if (![GIMessage.OP_ATOMIC, GIMessage.OP_KEY_UPDATE].includes(head.op)) {
+        throw new Error('Unsupported opcode: ' + head.op)
+      }
+
+      // Normalize the payload as if it were `OP_ATOMIC`
+      const payload = (head.op === GIMessage.OP_KEY_UPDATE)
+        ? [[GIMessage.OP_KEY_UPDATE, data.valueOf()]]
+        : data.valueOf()
+
+      // Find the key with the name 'iek', and the `meta.private.oldKeys` field
+      // within it
+      return payload
+        .filter(([op]) => op === GIMessage.OP_KEY_UPDATE)
+        .flatMap(([, keys]) => keys)
+        .find((key) => key.name === 'iek' && key.meta?.private?.oldKeys)
+        ?.meta.private.oldKeys
+    })()
+
+    // Check if old keys are present in the metadata
+    if (!oldKeys) {
+      console.error('[processOldIekList] Error finding old IEKs, logging in will probably fail due to missing keys')
+    }
+
+    // Decrypt the old IEK list
+    const decryptedKeys = decryptOldIekList(identityContractID, IEK, oldKeys)
+
+    // Check if decryption was successful
+    if (!decryptedKeys) {
+      console.error('[processOldIekList] Error decrypting old IEKs, logging in will probably fail due to missing keys')
+    } else {
+      // Map the decrypted keys to the required format
+      const secretKeys = decryptedKeys.map(key => ({ key: deserializeKey(key), transient: true }))
+
+      // Store the secret keys using the sbp function
+      await sbp('chelonia/storeSecretKeys', new Secret(secretKeys))
+    }
+  } catch (error) {
+    console.error('[processOldIekList] Error fetching or processing old keys:', error)
+  }
+}
+
+/**
+ * Appends a new IEK to the existing list of old IEKs.
+ *
+ * @param contractID - The ID of the contract.
+ * @param IEK - The encryption key object.
+ * @param oldIEK - The old IEK to be appended.
+ * @param encryptedData - The encrypted data string, or null if not available.
+ * @returns The updated encrypted data containing the new IEK.
+ * @throws {Error} - Throws an error if decryption of old IEK list fails.
+ */
+const appendToIekList = (contractID: string, IEK: Object, oldIEK: Object, encryptedData: ?string) => {
+  // Decrypt the old IEK list
+  const oldKeys = decryptOldIekList(contractID, oldIEK, encryptedData)
+
+  // If decryption fails, throw an error to prevent data loss
+  if (!oldKeys) {
+    throw new Error('Error decrypting old IEK list')
+  }
+
+  // Create a Set to store unique keys
+  const keysSet = new Set(oldKeys)
+
+  // Serialize the old IEK and add it to the Set
+  const serializedOldIEK = serializeKey(oldIEK, true)
+  keysSet.add(serializedOldIEK)
+
+  // Encrypt the updated list of keys and return the new encrypted data
+  const updatedKeysData = encryptedOutgoingDataWithRawKey(
+    IEK,
+    // Convert Set back to Array for serialization
+    JSON.stringify(Array.from(keysSet))
+  ).toString(`meta.private.oldKeys;${contractID}`)
+
+  return updatedKeysData // Return the updated encrypted data
+}
+
+// Event handler to detect password updates
+sbp('okTurtles.events/on', EVENT_HANDLED, (contractID, message) => {
+  const identityContractID = sbp('state/vuex/state').loggedIn?.identityContractID
+  // If the message isn't for our identity contract or it's not `OP_KEY_UPDATE`
+  // (possibly within `OP_ATOMIC`), we return early
+  if (contractID !== identityContractID || ![GIMessage.OP_ATOMIC, GIMessage.OP_KEY_UPDATE].includes(message.opType())) return
+
+  // If this could have changed our CSK, let's try to get the key ID and see if
+  // we have the corresponding secret key
+  const hasNewCsk = sbp('chelonia/contract/currentKeyIdByName', identityContractID, 'csk', true)
+  // If we do, we can still use the contract as normal
+  if (hasNewCsk) return
+
+  // Otherwise, force a logout
+  console.warn('Likely password change for identity contract. Logging us out.', identityContractID)
+  sbp('gi.actions/identity/logout').catch(e => {
+    console.error('Error while automatically logging out', e)
+  })
+})
+
 export default (sbp('sbp/selectors/register', {
   'gi.actions/identity/create': async function ({
-    IPK,
-    IEK,
+    IPK: wIPK,
+    IEK: wIEK,
     publishOptions,
     username,
     email,
@@ -36,8 +187,12 @@ export default (sbp('sbp/selectors/register', {
   }) {
     let finalPicture = `${self.location.origin}/assets/images/user-avatar-default.png`
 
-    IPK = typeof IPK === 'string' ? deserializeKey(IPK) : IPK
-    IEK = typeof IEK === 'string' ? deserializeKey(IEK) : IEK
+    // Unwrap secrets
+    wIPK = wIPK.valueOf()
+    wIEK = wIEK.valueOf()
+
+    const IPK = typeof wIPK === 'string' ? deserializeKey(wIPK) : wIPK
+    const IEK = typeof wIEK === 'string' ? deserializeKey(wIEK) : wIEK
 
     // Create the necessary keys to initialise the contract
     const CSK = keygen(EDWARDS25519SHA512BATCH)
@@ -217,9 +372,9 @@ export default (sbp('sbp/selectors/register', {
         namespaceRegistration: username
       })
 
-      // After the contract has been created, store pesistent keys
+      // After the contract has been created, store persistent keys
       await sbp('chelonia/storeSecretKeys',
-        new Secret([CEK, CSK, PEK].map(key => ({ key })))
+        new Secret([CEK, CSK, PEK, SAK].map(key => ({ key })))
       )
       // And remove transient keys, which require a user password
       sbp('chelonia/clearTransientSecretKeys', [IEKid, IPKid])
@@ -232,7 +387,7 @@ export default (sbp('sbp/selectors/register', {
     }
     return userID
   },
-  'gi.actions/identity/login': function ({ identityContractID, encryptionParams, cheloniaState, state, transientSecretKeys }) {
+  'gi.actions/identity/login': function ({ identityContractID, encryptionParams, cheloniaState, state, transientSecretKeys, oldKeysAnchorCid }) {
     // This wrapper ensures that there is at most one login flow action executed
     // at any given time. Because of the async work done when logging in and out,
     // it could happen that, e.g., `gi.actions/identity/login` is called before
@@ -243,7 +398,7 @@ export default (sbp('sbp/selectors/register', {
     // a queue.
     return sbp('okTurtles.eventQueue/queueEvent', 'ACTIONS-LOGIN', async () => {
       console.debug('[gi.actions/identity/login] Scheduled call starting', identityContractID)
-      transientSecretKeys = transientSecretKeys.map(k => ({ key: deserializeKey(k.valueOf()), transient: true }))
+      transientSecretKeys = transientSecretKeys.valueOf().map(k => ({ key: deserializeKey(k), transient: true }))
 
       // If running in a SW, start log capture here
       if (typeof WorkerGlobalScope === 'function') {
@@ -252,6 +407,10 @@ export default (sbp('sbp/selectors/register', {
       await sbp('chelonia/reset', { ...cheloniaState, loggedIn: { identityContractID } })
       await sbp('chelonia/storeSecretKeys', new Secret(transientSecretKeys))
 
+      if (oldKeysAnchorCid) {
+        await processOldIekList(identityContractID, oldKeysAnchorCid, transientSecretKeys[0].key)
+      }
+
       try {
         if (!state) {
         // Make sure we don't unsubscribe from our own identity contract
@@ -678,6 +837,138 @@ export default (sbp('sbp/selectors/register', {
   'gi.actions/identity/logout': (...params) => {
     return sbp('okTurtles.eventQueue/queueEvent', 'ACTIONS-LOGIN', ['gi.actions/identity/_private/logout', ...params])
   },
+  'gi.actions/identity/changePassword': async ({
+    identityContractID,
+    username,
+    oldIPK,
+    oldIEK,
+    newIPK: IPK,
+    newIEK: IEK,
+    updateToken,
+    hooks
+  }) => {
+    oldIPK = oldIPK.valueOf()
+    oldIEK = oldIEK.valueOf()
+    IPK = IPK.valueOf()
+    IEK = IEK.valueOf()
+    updateToken = updateToken.valueOf()
+
+    // Create the necessary keys to initialise the contract
+    const CSK = keygen(EDWARDS25519SHA512BATCH)
+    const CEK = keygen(CURVE25519XSALSA20POLY1305)
+    const SAK = keygen(EDWARDS25519SHA512BATCH)
+
+    // Key IDs
+    const oldIPKid = keyId(oldIPK)
+    const oldIEKid = keyId(oldIEK)
+    const IPKid = keyId(IPK)
+    const IEKid = keyId(IEK)
+    const CSKid = keyId(CSK)
+    const CEKid = keyId(CEK)
+    const SAKid = keyId(SAK)
+
+    // Public keys to be stored in the contract
+    const IPKp = serializeKey(IPK, false)
+    const IEKp = serializeKey(IEK, false)
+    const CSKp = serializeKey(CSK, false)
+    const CEKp = serializeKey(CEK, false)
+    const SAKp = serializeKey(SAK, false)
+
+    // Secret keys to be stored encrypted in the contract
+    const CSKs = encryptedOutgoingDataWithRawKey(IEK, serializeKey(CSK, true))
+    const CEKs = encryptedOutgoingDataWithRawKey(IEK, serializeKey(CEK, true))
+    const SAKs = encryptedOutgoingDataWithRawKey(IEK, serializeKey(SAK, true))
+
+    const state = sbp('chelonia/contract/state', identityContractID)
+
+    // Before rotating keys the contract, put all keys into transient store
+    await sbp('chelonia/storeSecretKeys',
+      new Secret([oldIPK, oldIEK, IPK, IEK, CEK, CSK, SAK].map(key => ({ key, transient: true })))
+    )
+
+    const oldKeysData = appendToIekList(
+      identityContractID, IEK, oldIEK,
+      state._vm.authorizedKeys[oldIEKid]?.meta?.private?.oldKeys
+    )
+
+    await sbp('chelonia/out/keyUpdate', {
+      contractID: identityContractID,
+      contractName: 'gi.contracts/identity',
+      data: [
+        {
+          id: IPKid,
+          name: 'ipk',
+          oldKeyId: oldIPKid,
+          meta: {
+            private: {
+              transient: true
+            }
+          },
+          data: IPKp
+        },
+        {
+          id: IEKid,
+          name: 'iek',
+          oldKeyId: oldIEKid,
+          meta: {
+            private: {
+              transient: true,
+              oldKeys: oldKeysData
+            }
+          },
+          data: IEKp
+        },
+        {
+          id: CSKid,
+          name: 'csk',
+          oldKeyId: findKeyIdByName(state, 'csk'),
+          meta: {
+            private: {
+              content: CSKs
+            }
+          },
+          data: CSKp
+        },
+        {
+          id: CEKid,
+          name: 'cek',
+          oldKeyId: findKeyIdByName(state, 'cek'),
+          meta: {
+            private: {
+              content: CEKs
+            }
+          },
+          data: CEKp
+        },
+        {
+          id: SAKid,
+          name: '#sak',
+          oldKeyId: findKeyIdByName(state, '#sak'),
+          meta: {
+            private: {
+              content: SAKs
+            }
+          },
+          data: SAKp
+        }
+      ],
+      signingKeyId: oldIPKid,
+      publishOptions: {
+        headers: {
+          'shelter-name': username,
+          'shelter-salt-update-token': updateToken
+        }
+      },
+      hooks
+    })
+
+    // After the contract has been updated, store persistent keys
+    await sbp('chelonia/storeSecretKeys',
+      new Secret([CEK, CSK, SAK].map(key => ({ key })))
+    )
+    // And remove transient keys, which require a user password
+    sbp('chelonia/clearTransientSecretKeys', [oldIEKid, oldIPKid, IEKid, IPKid])
+  },
   ...encryptedAction('gi.actions/identity/saveFileDeleteToken', L('Failed to save delete tokens for the attachments.')),
   ...encryptedAction('gi.actions/identity/removeFileDeleteToken', L('Failed to remove delete tokens for the attachments.')),
   ...encryptedAction('gi.actions/identity/setGroupAttributes', L('Failed to set group attributes.'))
diff --git a/frontend/controller/app/identity.js b/frontend/controller/app/identity.js
index d416aa025..dc0bc521d 100644
--- a/frontend/controller/app/identity.js
+++ b/frontend/controller/app/identity.js
@@ -7,7 +7,7 @@ import Vue from 'vue'
 import { LOGIN, LOGIN_COMPLETE, LOGIN_ERROR, NEW_PREFERENCES, NEW_UNREAD_MESSAGES } from '~/frontend/utils/events.js'
 import { Secret } from '~/shared/domains/chelonia/Secret.js'
 import { EVENT_HANDLED } from '~/shared/domains/chelonia/events.js'
-import { boxKeyPair, buildRegisterSaltRequest, computeCAndHc, decryptContractSalt, hash, hashPassword, randomNonce } from '~/shared/zkpp.js'
+import { boxKeyPair, buildRegisterSaltRequest, buildUpdateSaltRequestEc, computeCAndHc, decryptContractSalt, hash, hashPassword, randomNonce } from '~/shared/zkpp.js'
 // Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
 import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, deriveKeyFromPassword, serializeKey } from '../../../shared/domains/chelonia/crypto.js'
 import { handleFetchResult } from '../utils/misc.js'
@@ -168,7 +168,7 @@ sbp('okTurtles.events/on', LOGOUT, (a) => {
 */
 
 export default (sbp('sbp/selectors/register', {
-  'gi.app/identity/retrieveSalt': async (username: string, password: Secret<string>) => {
+  'gi.app/identity/retrieveSalt': async (username: string, password: Secret<string>): Promise<[string, ?string]> => {
     const r = randomNonce()
     const b = hash(r)
     const authHash = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/${encodeURIComponent(username)}/auth_hash?b=${encodeURIComponent(b)}`)
@@ -187,7 +187,41 @@ export default (sbp('sbp/selectors/register', {
       'hc': Buffer.from(hc).toString('base64').replace(/\//g, '_').replace(/\+/g, '-').replace(/=*$/, '')
     })).toString()}`).then(handleFetchResult('text'))
 
-    return decryptContractSalt(c, contractHash)
+    // [contractSalt, cid]
+    return JSON.parse(decryptContractSalt(c, contractHash))
+  },
+  'gi.app/identity/updateSaltRequest': async (username: string, oldPassword: Secret<string>, newPassword: Secret<string>) => {
+    const r = randomNonce()
+    const b = hash(r)
+    const authHash = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/${encodeURIComponent(username)}/auth_hash?b=${encodeURIComponent(b)}`)
+      .then(handleFetchResult('json'))
+
+    const { authSalt, s, sig } = authHash
+
+    const h = await hashPassword(oldPassword.valueOf(), authSalt)
+
+    const [c, hc] = computeCAndHc(r, s, h)
+
+    const [contractSalt, encryptedArgs] = await buildUpdateSaltRequestEc(newPassword.valueOf(), c)
+
+    const response = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/${encodeURIComponent(username)}/updatePasswordHash`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded'
+      },
+      body:
+        `${(new URLSearchParams({
+          'r': r,
+          's': s,
+          'sig': sig,
+          'hc': Buffer.from(hc).toString('base64').replace(/\//g, '_').replace(/\+/g, '-').replace(/=*$/, ''),
+          'Ea': encryptedArgs
+        })).toString()}`
+    }).then(handleFetchResult('text'))
+
+    const [oldContractSalt, updateToken] = JSON.parse(decryptContractSalt(c, response))
+
+    return [contractSalt, oldContractSalt, updateToken]
   },
   'gi.app/identity/create': async function ({
     data: { username, email, password, picture },
@@ -220,9 +254,8 @@ export default (sbp('sbp/selectors/register', {
     // next create the identity contract itself
     try {
       const userID = await sbp('gi.actions/identity/create', {
-        // TODO: Wrap IPK and IEK in "Secret"
-        IPK: serializeKey(IPK, true),
-        IEK: serializeKey(IEK, true),
+        IPK: new Secret(serializeKey(IPK, true)),
+        IEK: new Secret(serializeKey(IEK, true)),
         publishOptions,
         username,
         email,
@@ -286,14 +319,16 @@ export default (sbp('sbp/selectors/register', {
 
       const password = wpassword?.valueOf()
       const transientSecretKeys = []
+      let oldKeysAnchorCid
 
       // If we're creating a new session, here we derive the IEK. This key (not
       // the password) will be passed to the service worker.
       if (password) {
         try {
-          const salt = await sbp('gi.app/identity/retrieveSalt', username, wpassword)
+          const [salt, cid] = await sbp('gi.app/identity/retrieveSalt', username, wpassword)
           const IEK = await deriveKeyFromPassword(CURVE25519XSALSA20POLY1305, password, salt)
           transientSecretKeys.push(IEK)
+          oldKeysAnchorCid = cid
         } catch (e) {
           console.error('caught error calling retrieveSalt:', e)
           throw new GIErrorUIRuntimeError(L('Incorrect username or password'))
@@ -343,7 +378,14 @@ export default (sbp('sbp/selectors/register', {
             // and `state` will be sent back to replace the current Vuex state
             // after login. When using a service worker, all tabs will receive
             // a new Vuex state to replace their state with.
-            await sbp('gi.actions/identity/login', { identityContractID, encryptionParams, cheloniaState, state, transientSecretKeys: transientSecretKeys.map(k => new Secret(serializeKey(k, true))) })
+            await sbp('gi.actions/identity/login', {
+              identityContractID,
+              encryptionParams,
+              cheloniaState,
+              state,
+              transientSecretKeys: new Secret(transientSecretKeys.map(k => serializeKey(k, true))),
+              oldKeysAnchorCid
+            })
           } else {
             try {
               await sbp('chelonia/contract/sync', identityContractID)
@@ -434,5 +476,32 @@ export default (sbp('sbp/selectors/register', {
   },
   'gi.app/identity/logout': (...params) => {
     return sbp('okTurtles.eventQueue/queueEvent', 'APP-LOGIN', ['gi.app/identity/_private/logout', ...params])
+  },
+  'gi.app/identity/changePassword': async (wOldPassword: Secret<string>, wNewPassword: Secret<string>) => {
+    const state = sbp('state/vuex/state')
+    if (!state.loggedIn) return
+    const getters = sbp('state/vuex/getters')
+
+    const { identityContractID } = state.loggedIn
+    const username = getters.usernameFromID(identityContractID)
+    const oldPassword = wOldPassword.valueOf()
+    const newPassword = wNewPassword.valueOf()
+
+    const [newContractSalt, oldContractSalt, updateToken] = await sbp('gi.app/identity/updateSaltRequest', username, wOldPassword, wNewPassword)
+
+    const oldIPK = await deriveKeyFromPassword(EDWARDS25519SHA512BATCH, oldPassword, oldContractSalt)
+    const oldIEK = await deriveKeyFromPassword(CURVE25519XSALSA20POLY1305, oldPassword, oldContractSalt)
+    const newIPK = await deriveKeyFromPassword(EDWARDS25519SHA512BATCH, newPassword, newContractSalt)
+    const newIEK = await deriveKeyFromPassword(CURVE25519XSALSA20POLY1305, newPassword, newContractSalt)
+
+    return sbp('gi.actions/identity/changePassword', {
+      identityContractID,
+      username,
+      oldIPK: new Secret(oldIPK),
+      oldIEK: new Secret(oldIEK),
+      newIPK: new Secret(newIPK),
+      newIEK: new Secret(newIEK),
+      updateToken: new Secret(updateToken)
+    })
   }
 }): string[])
diff --git a/frontend/controller/serviceworkers/sw-primary.js b/frontend/controller/serviceworkers/sw-primary.js
index c4e3e7910..b83245b7b 100644
--- a/frontend/controller/serviceworkers/sw-primary.js
+++ b/frontend/controller/serviceworkers/sw-primary.js
@@ -169,6 +169,7 @@ sbp('sbp/selectors/register', {
   'appLogs/save': () => sbp('swLogs/save')
 })
 
+sbp('okTurtles.data/set', 'API_URL', self.location.origin)
 setupRootState()
 const setupPromise = setupChelonia()
 
diff --git a/frontend/setupChelonia.js b/frontend/setupChelonia.js
index dde4dab1e..a3f5217fa 100644
--- a/frontend/setupChelonia.js
+++ b/frontend/setupChelonia.js
@@ -61,9 +61,6 @@ const setupChelonia = async (): Promise<*> => {
     }
   })
 
-  // this is to ensure compatibility between frontend and test/backend.test.js
-  sbp('okTurtles.data/set', 'API_URL', self.location.origin)
-
   // Used in 'chelonia/configure' hooks to emit an error notification.
   const errorNotification = (activity: string, error: Error, message: GIMessage) => {
     sbp('gi.notifications/emit', 'CHELONIA_ERROR', { createdDate: new Date().toISOString(), activity, error, message })
diff --git a/frontend/views/containers/access/PasswordModal.vue b/frontend/views/containers/access/PasswordModal.vue
index fd5fb7d1f..71e40f451 100644
--- a/frontend/views/containers/access/PasswordModal.vue
+++ b/frontend/views/containers/access/PasswordModal.vue
@@ -1,5 +1,5 @@
 <template lang='pug'>
-modal-template(class='is-centered is-left-aligned' back-on-mobile=true ref='modalTemplate' :a11yTitle='L("Change Password")')
+modal-template(class='is-centered is-left-aligned' back-on-mobile=true ref='modalTemplate' data-test='PasswordModal' :a11yTitle='L("Change Password")')
   template(slot='title') Change password
 
   form(
@@ -14,7 +14,6 @@ modal-template(class='is-centered is-left-aligned' back-on-mobile=true ref='moda
       :value='form'
       :$v='$v'
       @enter='changePassword'
-      @input='(password) => { newPassword = password }'
       :hasIconRight='true'
       :showPlaceholder='false'
       :showPassword='false'
@@ -27,7 +26,6 @@ modal-template(class='is-centered is-left-aligned' back-on-mobile=true ref='moda
       :value='form'
       :$v='$v'
       @enter='changePassword'
-      @input='(password) => { newPassword = password }'
       :hasIconRight='true'
       :showPlaceholder='false'
       :showPassword='false'
@@ -40,34 +38,40 @@ modal-template(class='is-centered is-left-aligned' back-on-mobile=true ref='moda
       :value='form'
       :$v='$v'
       @enter='changePassword'
-      @input='(password) => { newPassword = password }'
       :hasIconRight='true'
       :showPlaceholder='false'
       :showPassword='false'
       size='is-large'
     )
 
+    banner-scoped(ref='formMsg')
+
     .buttons
       i18n.is-outlined(
         tag='button'
+        type='button'
+        data-test='cancel'
         @click='closeModal'
       ) Cancel
 
-      i18n.is-success(
-        tag='button'
+      button-submit(
         @click='changePassword'
-        :disabled='$v.form.$invalid'
-      ) Change password
-
-  template(slot='errors') {{ form.response }}
+        data-test='submit'
+        :disabled='$v.form.$invalid || processing'
+      ) {{ L('Change password') }}
 </template>
 <script>
 import { validationMixin } from 'vuelidate'
 import ModalTemplate from '@components/modal/ModalTemplate.vue'
+import BannerScoped from '@components/banners/BannerScoped.vue'
+import ButtonSubmit from '@components/ButtonSubmit.vue'
 import PasswordForm from '@containers/access/PasswordForm.vue'
+import { IDENTITY_PASSWORD_MIN_CHARS as passwordMinChars } from '@model/contracts/shared/constants.js'
+import sbp from '@sbp/sbp'
 import { required, minLength } from 'vuelidate/lib/validators'
 import sameAs from 'vuelidate/lib/validators/sameAs.js'
 import { L } from '@common/common.js'
+import { Secret } from '~/shared/domains/chelonia/Secret.js'
 
 export default ({
   name: 'PasswordModal',
@@ -78,38 +82,29 @@ export default ({
         current: null,
         newPassword: null,
         confirm: null
-      }
+      },
+      processing: false
     }
   },
   validations: {
     form: {
       current: {
-        required,
-        checkOldPassword: value => {
-          // TODO
-          console.log('Todo: check password')
-          if (value === '') return false
-
-          // simulate async call, fail for all logins with even length
-          return new Promise((resolve, reject) => {
-            setTimeout(() => {
-              resolve(typeof value === 'string' && value.length % 2 !== 0)
-            }, 350 + Math.random() * 300)
-          })
-        }
+        [L('Your current password is required.')]: required
       },
       newPassword: {
-        required,
+        [L('A password is required.')]: required,
         nonWhitespace: value => /^\S+$/.test(value),
-        minLength: minLength(7)
+        [L('Your password must be at least {minChars} characters long.', { minChars: passwordMinChars })]: minLength(passwordMinChars)
       },
       confirm: {
-        required,
-        sameAsPassword: sameAs('newPassword')
+        [L('Please confirm your password.')]: required,
+        [L('Passwords do not match.')]: sameAs('newPassword')
       }
     }
   },
   components: {
+    BannerScoped,
+    ButtonSubmit,
     ModalTemplate,
     PasswordForm
   },
@@ -119,13 +114,22 @@ export default ({
       this.$refs.modalTemplate.close()
     },
     changePassword () {
-      try {
-        // TODO check password
-        this.closeModal()
-      } catch (error) {
-        this.form.response = L('Invalid password')
-        console.error(error)
-      }
+      if (this.processing) return
+      this.processing = true
+      ;(async () => {
+        try {
+          await sbp('gi.app/identity/changePassword',
+            new Secret(this.form.current),
+            new Secret(this.form.newPassword)
+          )
+          this.closeModal()
+        } catch (error) {
+          console.error('[PasswordModal.vue]', error)
+          this.$refs.formMsg.danger(L('Invalid password'))
+        }
+      })().finally(() => {
+        this.processing = false
+      })
     }
   }
 }: Object)
diff --git a/frontend/views/containers/user-settings/UserProfile.vue b/frontend/views/containers/user-settings/UserProfile.vue
index cca6141e9..e103cbc12 100644
--- a/frontend/views/containers/user-settings/UserProfile.vue
+++ b/frontend/views/containers/user-settings/UserProfile.vue
@@ -57,7 +57,7 @@
             tag='button'
             type='button'
             data-test='passwordBtn'
-            @click.prevent='onUpdatePasswordClick'
+            @click.prevent='openModal("PasswordModal")'
           ) Update Password
 
         banner-scoped(ref='formMsg' data-test='profileMsg')
@@ -73,6 +73,7 @@
         i18n.is-title-3(tag='h3' class='card-header') Delete account
         p
           i18n Deleting your account will erase all your data, and remove you from the groups you belong to.
+          | {{ ' ' }}
           i18n.is-danger This action cannot be undone.
 
         .buttons
@@ -95,7 +96,7 @@ import BannerScoped from '@components/banners/BannerScoped.vue'
 import AvatarUpload from '@components/AvatarUpload.vue'
 import ButtonSubmit from '@components/ButtonSubmit.vue'
 import CharLengthIndicator from '@components/CharLengthIndicator.vue'
-import { L, LTags } from '@common/common.js'
+import { L } from '@common/common.js'
 import { IDENTITY_BIO_MAX_CHARS, IDENTITY_USERNAME_MAX_CHARS } from '@model/contracts/shared/constants.js'
 export default ({
   name: 'UserProfile',
@@ -154,14 +155,6 @@ export default ({
       sbp('okTurtles.events/emit', OPEN_MODAL, mode)
       return false
     },
-    onUpdatePasswordClick () {
-      // TODO: use 'PasswordModal.vue' instead, once the password update is implemented in the app.
-      sbp('gi.ui/prompt', {
-        heading: L('Feature coming soon'),
-        question: L('Sorry, this feature has not been implemented yet.{br_}Please check back later.', { ...LTags() }),
-        primaryButton: L('OK')
-      })
-    },
     async saveProfile () {
       this.$refs.formMsg.clean()
       const attrs = {}
diff --git a/shared/domains/chelonia/Secret.js b/shared/domains/chelonia/Secret.js
index 5277b61ae..71254e4e9 100644
--- a/shared/domains/chelonia/Secret.js
+++ b/shared/domains/chelonia/Secret.js
@@ -4,9 +4,13 @@ import { serdesDeserializeSymbol, serdesSerializeSymbol, serdesTagSymbol } from
 
 /* Wrapper class for secrets, which identifies them as such and prevents them
 from being logged */
-export class Secret<T> {
-  _content: T
 
+// Use a `WeakMap` to store the actual secret outside of the returned `Secret`
+// object. This ensures that the only way to access the secret is via the
+// `.valueOf()` method, and it prevents accidentally logging things that
+// shouldn't be logged.
+const wm = new WeakMap()
+export class Secret<T> {
   // $FlowFixMe[unsupported-syntax]
   static [serdesDeserializeSymbol] (secret) {
     return new this(secret)
@@ -14,7 +18,7 @@ export class Secret<T> {
 
   // $FlowFixMe[unsupported-syntax]
   static [serdesSerializeSymbol] (secret: Secret) {
-    return secret._content
+    return wm.get(secret)
   }
 
   // $FlowFixMe[unsupported-syntax]
@@ -23,10 +27,13 @@ export class Secret<T> {
   }
 
   constructor (value: T) {
-    this._content = value
+    // $FlowFixMe[escaped-generic]
+    wm.set(this, value)
   }
 
   valueOf (): T {
-    return this._content
+    // $FlowFixMe[escaped-generic]
+    // $FlowFixMe[incompatible-return]
+    return wm.get(this)
   }
 }
diff --git a/shared/domains/chelonia/encryptedData.js b/shared/domains/chelonia/encryptedData.js
index cdd27cf6a..3375ecd6f 100644
--- a/shared/domains/chelonia/encryptedData.js
+++ b/shared/domains/chelonia/encryptedData.js
@@ -8,10 +8,20 @@ import { isRawSignedData, signedIncomingData } from './signedData.js'
 const rootStateFn = () => sbp('chelonia/rootState')
 
 export interface EncryptedData<T> {
+  // The ID of the encryption key used
   encryptionKeyId: string,
+  // The unencrypted data. For outgoing data, this is the original data given
+  // as input. For incoming data, decryption will be attempted.
   valueOf: () => T,
+  // The serialized _encrypted_ data. For outgoing data, encryption will be
+  // attempted. For incoming data, this is the original data given as input.
+  // The `additionalData` parameter is only used for outgoing data, and binds
+  // the encrypted payload to additional information.
   serialize: (additionalData: ?string) => [string, string],
+  // A string version of the serialized encrypted data (i.e., `JSON.stringify()`)
   toString: (additionalData: ?string) => string,
+  // For incoming data, this is an alias of `serialize`. Undefined for outgoing
+  // data.
   toJSON?: () => [string, string]
 }
 
@@ -277,6 +287,51 @@ export const encryptedIncomingForeignData = <T>(contractID: string, _0: any, dat
   })
 }
 
+export const encryptedIncomingDataWithRawKey = <T>(key: Key, data: any, additionalData?: string): EncryptedData<T> => {
+  if (data === undefined || !key) throw new TypeError('Invalid invocation')
+
+  let decryptedValue
+  const eKeyId = keyId(key)
+  const decryptedValueFn = (): any => {
+    if (decryptedValue) {
+      return decryptedValue
+    }
+    const state = {
+      _vm: {
+        authorizedKeys: {
+          [eKeyId]: {
+            purpose: ['enc'],
+            data: serializeKey(key, false),
+            _notBeforeHeight: 0,
+            _notAfterHeight: undefined
+          }
+        }
+      }
+    }
+    decryptedValue = decryptData.call(state, NaN, data, { [eKeyId]: key }, additionalData || '')
+
+    return decryptedValue
+  }
+
+  return wrapper({
+    get encryptionKeyId () {
+      return encryptedDataKeyId(data)
+    },
+    get serialize () {
+      return () => data
+    },
+    get toString () {
+      return () => JSON.stringify(this.serialize())
+    },
+    get valueOf () {
+      return decryptedValueFn
+    },
+    get toJSON () {
+      return this.serialize
+    }
+  })
+}
+
 export const encryptedDataKeyId = (data: any): string => {
   if (!isRawEncryptedData(data)) {
     throw new ChelErrorDecryptionError('Invalid message format')
diff --git a/shared/domains/chelonia/signedData.js b/shared/domains/chelonia/signedData.js
index 8e42c9aa6..e7bb693c2 100644
--- a/shared/domains/chelonia/signedData.js
+++ b/shared/domains/chelonia/signedData.js
@@ -8,13 +8,28 @@ import { ChelErrorSignatureError, ChelErrorSignatureKeyNotFound, ChelErrorSignat
 const rootStateFn = () => sbp('chelonia/rootState')
 
 export interface SignedData<T> {
+  // The ID of the signing key used
   signingKeyId: string,
+  // The unsigned data. For outgoing data, this is the original data given
+  // as input. For incoming data, signature verification will be attempted.
   valueOf: () => T,
+  // The serialized _signed_ data. For outgoing data, signing will be
+  // attempted. For incoming data, this is the original data given as input.
+  // The `additionalData` parameter is only used for outgoing data, and binds
+  // the signed payload to additional information.
   serialize: (additionalData: ?string) => { _signedData: [string, string, string] },
+  // Data needed to recreate signed data.
+  // [contractID, data, height, additionalData]
   context?: [string, Object, number, string],
+  // A string version of the serialized signed data (i.e., `JSON.stringify()`)
   toString: (additionalData: ?string) => string,
+  // For outgoing data, recreate SignedData using different data and the same
+  // parameters
   recreate?: (data: T) => SignedData<T>,
+  // For incoming data, this is an alias of `serialize`. Undefined for outgoing
+  // data.
   toJSON?: () => [string, string],
+  // `get` and `set` can set additional (unsigned) fields within `SignedData`
   get: (k: string) => any,
   set?: (k: string, v: any) => void
 }
diff --git a/shared/zkpp.js b/shared/zkpp.js
index 55ce56bf2..7ea50cc04 100644
--- a/shared/zkpp.js
+++ b/shared/zkpp.js
@@ -1,5 +1,6 @@
 import nacl from 'tweetnacl'
 import scrypt from 'scrypt-async'
+import { AUTHSALT, CONTRACTSALT, CS, SALT_LENGTH_IN_OCTETS, SU } from './zkppConstants.js'
 
 // .toString('base64url') only works in Node.js
 export const base64ToBase64url = (s: string): string => s.replace(/\//g, '_').replace(/\+/g, '-').replace(/=*$/, '')
@@ -18,7 +19,7 @@ export const randomNonce = (): string => {
   return base64ToBase64url(Buffer.from(nacl.randomBytes(12)).toString('base64'))
 }
 
-export const hash = (v: string): string => {
+export const hash = (v: string | Buffer): string => {
   return base64ToBase64url(Buffer.from(nacl.hash(Buffer.from(v))).toString('base64'))
 }
 
@@ -31,7 +32,7 @@ export const computeCAndHc = (r: string, s: string, h: string): [Uint8Array, Uin
 }
 
 export const encryptContractSalt = (c: Uint8Array, contractSalt: string): string => {
-  const encryptionKey = hashRawStringArray('CS', c).slice(0, nacl.secretbox.keyLength)
+  const encryptionKey = hashRawStringArray(CS, c).slice(0, nacl.secretbox.keyLength)
   const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
 
   const encryptedContractSalt = nacl.secretbox(Buffer.from(contractSalt), nonce, encryptionKey)
@@ -40,7 +41,7 @@ export const encryptContractSalt = (c: Uint8Array, contractSalt: string): string
 }
 
 export const decryptContractSalt = (c: Uint8Array, encryptedContractSaltBox: string): string => {
-  const encryptionKey = hashRawStringArray('CS', c).slice(0, nacl.secretbox.keyLength)
+  const encryptionKey = hashRawStringArray(CS, c).slice(0, nacl.secretbox.keyLength)
   const encryptedContractSaltBoxBuf = Buffer.from(base64urlToBase64(encryptedContractSaltBox), 'base64')
 
   const nonce = encryptedContractSaltBoxBuf.slice(0, nacl.secretbox.nonceLength)
@@ -49,6 +50,27 @@ export const decryptContractSalt = (c: Uint8Array, encryptedContractSaltBox: str
   return Buffer.from(nacl.secretbox.open(encryptedContractSalt, nonce, encryptionKey)).toString()
 }
 
+export const encryptSaltUpdate = (secret: string, recordId: string, record: string): string => {
+  // The nonce is also used to derive a single-use encryption key
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+  const encryptionKey = hashRawStringArray(SU, secret, nonce, recordId).slice(0, nacl.secretbox.keyLength)
+
+  const encryptedRecord = nacl.secretbox(Buffer.from(record), nonce, encryptionKey)
+
+  return base64ToBase64url(Buffer.concat([nonce, encryptedRecord]).toString('base64'))
+}
+
+export const decryptSaltUpdate = (secret: string, recordId: string, encryptedRecordBox: string): string => {
+  // The nonce is also used to derive a single-use encryption key
+  const encryptedRecordBoxBuf = Buffer.from(base64urlToBase64(encryptedRecordBox), 'base64')
+  const nonce = encryptedRecordBoxBuf.slice(0, nacl.secretbox.nonceLength)
+  const encryptionKey = hashRawStringArray(SU, secret, nonce, recordId).slice(0, nacl.secretbox.keyLength)
+
+  const encryptedRecord = encryptedRecordBoxBuf.slice(nacl.secretbox.nonceLength)
+
+  return Buffer.from(nacl.secretbox.open(encryptedRecord, nonce, encryptionKey)).toString()
+}
+
 export const hashPassword = (password: string, salt: string): Promise<string> => {
   return new Promise(resolve => scrypt(password, salt, {
     N: 16384,
@@ -71,8 +93,8 @@ export const saltAgreement = (publicKey: string, secretKey: Uint8Array): false |
     return false
   }
 
-  const authSalt = Buffer.from(hashStringArray('AUTHSALT', dhKey)).slice(0, 18).toString('base64')
-  const contractSalt = Buffer.from(hashStringArray('CONTRACTSALT', dhKey)).slice(0, 18).toString('base64')
+  const authSalt = Buffer.from(hashStringArray(AUTHSALT, dhKey)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
+  const contractSalt = Buffer.from(hashStringArray(CONTRACTSALT, dhKey)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
 
   return [authSalt, contractSalt]
 }
@@ -114,3 +136,32 @@ export const buildRegisterSaltRequest = async (publicKey: string, secretKey: Uin
 
   return [contractSalt, base64ToBase64url(Buffer.concat([nonce, encryptedHashedPasswordBuf]).toString('base64'))]
 }
+
+// Build the `E_c` (encrypted arguments) to send to the server to negotiate a
+// password change. `password` corresponds to the raw user password, `c` is a
+// negotiated shared secret between the server and the client. The encrypted
+// payload contains the salted user password (using `authSalt`).
+// The return value includes the derived contract salt and the `E_c`.
+export const buildUpdateSaltRequestEc = async (password: string, c: Uint8Array): Promise<[string, string]> => {
+  // Derive S_A (authentication salt) and S_C (contract salt) as follows:
+  //   -> S_T -< BASE64(SHA-512(SHA-512(T) + SHA-512(c))[0..18]) with T being
+  //     `AUTHSALT` (for S_A) or `CONTRACTSALT` (for S_C).
+  // This way, we ensure both the server and the client contribute to the
+  //   salts' entropy. Having more sources of entropy contributes to higher
+  //   randomness in the result.
+  // When sending the encrypted data, the encrypted information would be
+  // `hashedPassword`, which needs to be verified server-side to verify
+  // it matches p and would be used to derive S_A and S_C.
+  const authSalt = Buffer.from(hashStringArray(AUTHSALT, c)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
+  const contractSalt = Buffer.from(hashStringArray(CONTRACTSALT, c)).slice(0, SALT_LENGTH_IN_OCTETS).toString('base64')
+
+  const encryptionKey = hashRawStringArray(SU, c).slice(0, nacl.secretbox.keyLength)
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+
+  const hashedPassword = await hashPassword(password, authSalt)
+  const encryptedArgsCiphertext = nacl.secretbox(Buffer.from(hashedPassword), nonce, encryptionKey)
+
+  const encryptedArgs = Buffer.concat([nonce, encryptedArgsCiphertext])
+
+  return [contractSalt, base64ToBase64url(encryptedArgs.toString('base64'))]
+}
diff --git a/shared/zkppConstants.js b/shared/zkppConstants.js
new file mode 100644
index 000000000..dddc2e1b8
--- /dev/null
+++ b/shared/zkppConstants.js
@@ -0,0 +1,6 @@
+export const AUTHSALT = 'AUTHSALT'
+export const CONTRACTSALT = 'CONTRACTSALT'
+export const CS = 'CS'
+export const SU = 'SU'
+
+export const SALT_LENGTH_IN_OCTETS = 24
diff --git a/test/cypress/integration/signup-and-login.spec.js b/test/cypress/integration/signup-and-login.spec.js
index a58ad2be8..0574529c2 100644
--- a/test/cypress/integration/signup-and-login.spec.js
+++ b/test/cypress/integration/signup-and-login.spec.js
@@ -113,4 +113,33 @@ describe('Signup, Profile and Login', () => {
 
     cy.closeModal()
   })
+
+  it('change user password', () => {
+    cy.giLogin(username)
+    cy.getByDT('settingsBtn').click()
+    cy.getByDT('passwordBtn').click()
+    const oldPassword = '123456789'
+    const newPassword = 'abcdefghi'
+    cy.getByDT('PasswordModal').within(() => {
+      cy.getByDT('current').type('{selectall}{del}' + oldPassword)
+      cy.getByDT('newPassword').type('{selectall}{del}' + newPassword)
+      cy.getByDT('confirm').type('{selectall}{del}' + newPassword)
+      cy.getByDT('submit').click()
+    })
+    cy.getByDT('PasswordModal').should('not.exist')
+    cy.giLogout({ bypassUI: true })
+
+    // Login using old password
+    cy.getByDT('loginBtn').click()
+    cy.getByDT('loginName').type('{selectall}{del}' + username)
+    cy.getByDT('password').type('{selectall}{del}' + oldPassword)
+
+    cy.getByDT('loginSubmit').click()
+    cy.getByDT('loginError').should('contain', 'Incorrect username or password')
+    cy.closeModal()
+
+    // Now, log in with the correct changed password
+    cy.giLogin(username, { password: newPassword })
+    cy.giLogout({ bypassUI: true })
+  })
 })