{
  "schema_version": 2,
  "id": "operate/rs/security/access-control/manage-passwords/rotate-passwords",
  "title": "Rotate passwords",
  "url": "https://redis.io/docs/latest/operate/rs/7.4/security/access-control/manage-passwords/rotate-passwords/",
  "summary": "Rotate user passwords.",
  "content": "\nRedis Enterprise Software lets you implement password rotation policies using the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\nYou can add a new password for a database user without immediately invalidating the old one (which might cause authentication errors in production).\n\n\u003e [!NOTE]\n\u003e Password rotation does not work for the default user. [Add additional users](https://redis.io/docs/latest/operate/rs/security/access-control/create-users) to enable password rotation.\n\n## Password rotation policies\n\nFor user access to the Redis Enterprise Software Cluster Manager UI,\nyou can set a [password expiration policy](https://redis.io/docs/latest/operate/rs/security/access-control/manage-passwords/password-expiration) to prompt the user to change their password.\n\nHowever, for database connections that rely on password authentication,\nyou need to allow for authentication with the existing password while you roll out the new password to your systems.\n\nWith the Redis Enterprise Software REST API, you can add additional passwords to a user account for authentication to the database or the Cluster Manager UI and API.\n\nAfter the old password is replaced in the database connections, you can delete the old password to finish the password rotation process.\n\n\u003e [!WARNING]\n\u003e Multiple passwords are only supported using the REST API.\n\u003e If you reset the password for a user in the Cluster Manager UI,\n\u003e the new password replaces all other passwords for that user.\n\nThe new password cannot already exist as a password for the user and must meet the [password complexity](https://redis.io/docs/latest/operate/rs/security/access-control/manage-passwords/password-complexity-rules) requirements, if enabled.\n\n## Rotate password\n\nTo rotate the password of a user account:\n\n1. Add an additional password to a user account with [`POST /v1/users/password`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users/password#add-password):\n\n    ```sh\n    POST https://[host][:port]/v1/users/password\n         '{\"username\":\"\u003cusername\u003e\", \"old_password\":\"\u003can_existing_password\u003e\", \"new_password\":\"\u003ca_new_password\u003e\"}'\n    ```\n\n    After you send this request, you can authenticate with both the old and the new password.\n\n1. Update the password in all database connections that connect with the user account.\n1. Delete the original password with [`DELETE /v1/users/password`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users/password#update-password):\n\n    ```sh\n    DELETE https://[host][:port]/v1/users/password\n           '{\"username\":\"\u003cusername\u003e\", \"old_password\":\"\u003can_existing_password\u003e\"}'\n    ```\n\n    If there is only one valid password for a user account, you cannot delete that password.\n\n## Replace all passwords\n\nYou can also replace all existing passwords for a user account with a single password that does not match any existing passwords.\nThis can be helpful if you suspect that your passwords are compromised and you want to quickly resecure the account.\n\nTo replace all existing passwords for a user account with a single new password, use [`PUT /v1/users/password`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users/password#delete-password):\n\n```sh\nPUT https://[host][:port]/v1/users/password\n    '{\"username\":\"\u003cusername\u003e\", \"old_password\":\"\u003can_existing_password\u003e\", \"new_password\":\"\u003ca_new_password\u003e\"}'\n```\n\nAll of the existing passwords are deleted and only the new password is valid.\n\n\u003e [!NOTE]\n\u003e If you send the above request without specifying it is a `PUT` request, the new password is added to the list of existing passwords.\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-10-21T09:46:20-07:00"
}