Change-password URL redirects to the form
What it checks
On a site with accounts, whether /.well-known/change-password sends the user to the change-password form.
| State | Verdict |
|---|---|
| No sampled page has a password field | notApplicable |
| The probe gets no response, or a status other than those below | notApplicable |
| 200 with no redirect and no password field (a catch-all page) | notApplicable |
| 404 or 410 | warn |
| 302, 303 or 307 to a page that answers 200, 401 or 403 | pass |
| 200 with a meta refresh | pass |
| 301 or 308 to a page that answers 200 | warn |
| 200 with a password field at the well-known URL itself | warn |
A redirect with no usable Location, or to a page that answers another 4xx or a 5xx |
fail |
Why it matters
A password manager that wants a user to change a password opens /.well-known/change-password on the site. If the URL redirects to the form, the user, or the browser acting for the user, lands on it. If it does not, the password manager has nowhere to send them.
Evidence
- The W3C draft: servers redirect “by returning a response with a redirect status of 302, 303, or 307, and a Location header”, may instead answer with an HTML meta refresh, and “must not locate the actual change password page at the change password url” — w3c.github.io/webappsec-change-password-url (verified 2026-10-18)
- Safari has supported the URL since 2019, and Chrome’s password manager since version 86 — web.dev/…/change-password-url (verified 2026-10-18)
- Chrome Automated Password Change navigates the site and completes the change for the user. “The URL /.well-known/change-password must redirect to your password change form.” The page is marked as information about an upcoming feature — developer.chrome.com/…/automated-password-change (verified 2026-10-18)
- IANA registers
change-passwordas provisional, change controller W3C — iana.org/…/well-known-uris.xhtml (verified 2026-10-18)
Counter-evidence: No consumer is documented as an AI agent. Chrome’s automated feature acts on the site for the user, but Google does not call it AI and still marks it as upcoming. The web.dev browser list dates from 2020.
Limits
- A site counts as having accounts only when a sampled page shows a password field. A login page outside the sample is not seen.
- A 200 at the well-known URL with no redirect and no form is read as a catch-all page, not as support.
- The redirect target is checked for its status only, not for a password form.
- Chrome Automated Password Change is still a preview. Its page says Google is “expanding feature coverage through testing across selected websites” and was last updated 2025-07-30 — developer.chrome.com/…/automated-password-change (verified 2026-10-18). The grade does not rest on it.
How it scores
Grade: C — the consumers are documented, but none is an AI agent, and the one automated consumer is still a preview. The audit is informative, so it never moves a score. It can be re-graded once Chrome ships Automated Password Change and the project decides whether browser automation that is not AI is in scope.
Example finding
/.well-known/change-password answers 302 Location: /account/password, and /account/password answers 404. A password manager sends the user to an error page.
Sources
- W3C — A Well-Known URL for Changing Passwords (Editor’s Draft) — W3C Web Application Security Working Group, draft-spec (verified 2026-10-18)
- web.dev — Help users change passwords easily by adding a well-known URL for changing passwords — Google (web.dev), vendor-doc (verified 2026-10-18)
- Chrome for Developers — Automated Password Change — Google (Chrome), vendor-doc (verified 2026-10-18)
- IANA Well-Known URIs registry — IANA, spec (verified 2026-10-18)
Limits
- A site counts as having accounts only when a sampled page shows a password field. A login page outside the sample is not seen.
- A 200 at the well-known URL with no redirect and no form is read as a catch-all page, not as support.
- The redirect target is checked for its status only, not for a password form.
- Chrome Automated Password Change is still a preview. Its page says Google is “expanding feature coverage through testing across selected websites” and was last updated 2025-07-30 — developer.chrome.com/…/automated-password-change (verified 2026-10-18). The grade does not rest on it.