diff --git a/approot/messages.xml b/approot/messages.xml
index 3f7cc85c..64a018fb 100644
--- a/approot/messages.xml
+++ b/approot/messages.xml
@@ -16,6 +16,7 @@
 <message id="Lms.password-bad-login-combination">Bad login / password combination</message>
 <message id="Lms.password-client-throttled">Login throttled, please try again later</message>
 <message id="Lms.password-confirm">Confirm password</message>
+<message id="Lms.password-old">Old password</message>
 <message id="Lms.password-too-weak">Password too weak</message>
 <message id="Lms.passwords-dont-match">Passwords don't match</message>
 <message id="Lms.quit-confirm">Are you sure?</message>
@@ -136,6 +137,8 @@
 <message id="Lms.Settings.account">Account</message>
 <message id="Lms.Settings.audio">Audio</message>
 <message id="Lms.Settings.demo-cannot-save">Cannot save using a demo account!</message>
+<message id="Lms.Settings.password-bad">Bad password</message>
+<message id="Lms.Settings.password-must-fill-old-password">Old password must be filled in</message>
 <message id="Lms.Settings.transcoding">Transcoding</message>
 <message id="Lms.Settings.transcoding-bitrate">Transcode bitrate</message>
 <message id="Lms.Settings.transcoding-format">Transcode format</message>
diff --git a/approot/messages_fr.xml b/approot/messages_fr.xml
index 64db088b..9b7b2ab5 100644
--- a/approot/messages_fr.xml
+++ b/approot/messages_fr.xml
@@ -16,6 +16,7 @@
 <message id="Lms.password-bad-login-combination">Mauvaise combinaison login / mot de passe</message>
 <message id="Lms.password-client-throttled">Trop de tentatives de connexion, veuillez réessayer plus tard</message>
 <message id="Lms.password-confirm">Confirmation du mot de passe</message>
+<message id="Lms.password-old">Ancien mot de passe</message>
 <message id="Lms.password-too-weak">Mot de passe trop faible</message>
 <message id="Lms.passwords-dont-match">Les mots de passe ne correspondent pas</message>
 <message id="Lms.quit-confirm">Êtes-vous sûr ?</message>
@@ -137,6 +138,8 @@
 <message id="Lms.Settings.audio">Audio</message>
 <message id="Lms.Settings.auto">Auto</message>
 <message id="Lms.Settings.demo-cannot-save">Impossible de sauvegarder en utilisant un compte de démo !</message>
+<message id="Lms.Settings.password-bad">Mauvais mot de passe</message>
+<message id="Lms.Settings.password-must-fill-old-password">L'ancien mot de passe doit être renseigné</message>
 <message id="Lms.Settings.transcoding">Transcodage</message>
 <message id="Lms.Settings.transcoding-bitrate">Bitrate du transcodage</message>
 <message id="Lms.Settings.transcoding-format">Format du transcodage</message>
@@ -151,5 +154,5 @@
 <!--Wt-->
 <message id="Wt.WMessageBox.Yes">Oui</message>
 <message id="Wt.WMessageBox.No">Non</message>
-
+<message id="Wt.WValidator.Invalid">Ce champ ne peut pas être vide</message>
 </messages>
diff --git a/approot/settings.xml b/approot/settings.xml
index 1b2d303b..5a56a11e 100644
--- a/approot/settings.xml
+++ b/approot/settings.xml
@@ -45,6 +45,19 @@
 	</div>
 	<legend>${tr:Lms.Settings.account}</legend>
 	<div class="form-horizontal">
+		${<if-has-old-password>}
+		<div class="form-group">
+			<label class="control-label col-sm-2"  for="${id:password-old}">
+				${tr:Lms.password-old}
+			</label>
+			<div class="col-sm-5">
+				${password-old}
+			</div>
+			<div class="help-block col-sm-5">
+				${password-old-info}
+			</div>
+		</div>
+		${</if-has-old-password>}
 		<div class="form-group">
 			<label class="control-label col-sm-2"  for="${id:password}">
 				${tr:Lms.password}
diff --git a/src/ui/LmsApplication.cpp b/src/ui/LmsApplication.cpp
index b5c57b53..de67145d 100644
--- a/src/ui/LmsApplication.cpp
+++ b/src/ui/LmsApplication.cpp
@@ -76,6 +76,12 @@ LmsApplication::getUser() const
 	return Database::User::getById(*_dbSession, *_userId);
 }
 
+bool
+LmsApplication::isUserAuthStrong() const
+{
+	return *_userAuthStrong;
+}
+
 bool
 LmsApplication::isUserAdmin() const
 {
@@ -171,12 +177,15 @@ LmsApplication::LmsApplication(const Wt::WEnvironment& env,
 	const auto userId {processAuthToken(env)};
 	if (userId)
 	{
-		handleUserLoggedIn(*userId);
+		handleUserLoggedIn(*userId, false);
 	}
 	else
 	{
 		Auth* auth {root()->addNew<Auth>()};
-		auth->userLoggedIn.connect(this, &LmsApplication::handleUserLoggedIn);
+		auth->userLoggedIn.connect(this, [this](Database::IdType userId)
+		{
+			handleUserLoggedIn(userId, true);
+		});
 	}
 }
 
@@ -342,16 +351,15 @@ LmsApplication::handleUserLoggedOut()
 }
 
 void
-LmsApplication::handleUserLoggedIn(Database::IdType userId)
+LmsApplication::handleUserLoggedIn(Database::IdType userId, bool strongAuth)
 {
 	_userId = userId;
+	_userAuthStrong = strongAuth;
 
 	root()->clear();
 
 	try
 	{
-//	post([this]
-//	{
 		const LmsApplicationInfo info {LmsApplicationInfo::fromEnvironment(environment())};
 
 		LMS_LOG(UI, INFO) << "User '" << getUserLoginName() << "' logged in from '" << environment().clientAddress() << "', user agent = " << environment().userAgent();
@@ -363,9 +371,6 @@ LmsApplication::handleUserLoggedIn(Database::IdType userId)
 		});
 
 		createHome();
-
-//		triggerUpdate();
-//	});
 	}
 	catch (std::exception& e)
 	{
diff --git a/src/ui/LmsApplication.hpp b/src/ui/LmsApplication.hpp
index 2d35867f..3b4acb4a 100644
--- a/src/ui/LmsApplication.hpp
+++ b/src/ui/LmsApplication.hpp
@@ -84,6 +84,7 @@ class LmsApplication : public Wt::WApplication
 		Database::Session& getDbSession() { return *_dbSession.get();}
 
 		Wt::Dbo::ptr<Database::User> getUser() const;
+		bool isUserAuthStrong() const; // user must be logged in prior this call
 		bool isUserAdmin() const; // user must be logged in prior this call
 		bool isUserDemo() const; // user must be logged in prior this call
 		std::string getUserLoginName() const; // user must be logged in prior this call
@@ -112,7 +113,7 @@ class LmsApplication : public Wt::WApplication
 
 		// Signal slots
 		void handleUserLoggedOut();
-		void handleUserLoggedIn(Database::IdType userId);
+		void handleUserLoggedIn(Database::IdType userId, bool strongAuth);
 
 		void notify(const Wt::WEvent& event) override;
 		void finalize() override;
@@ -123,7 +124,8 @@ class LmsApplication : public Wt::WApplication
 		std::unique_ptr<Database::Session>	_dbSession;
 		LmsApplicationGroupContainer&   	_appGroups;
 		Events					_events;
-		boost::optional<Database::IdType>	_userId {};
+		boost::optional<Database::IdType>	_userId;
+		boost::optional<bool>			_userAuthStrong;
 		std::shared_ptr<ImageResource>		_imageResource;
 		std::shared_ptr<AudioResource>		_audioResource;
 };
diff --git a/src/ui/SettingsView.cpp b/src/ui/SettingsView.cpp
index fc92f780..09a66732 100644
--- a/src/ui/SettingsView.cpp
+++ b/src/ui/SettingsView.cpp
@@ -47,17 +47,22 @@ class SettingsModel : public Wt::WFormModel
 		static const Field TranscodeEnableField;
 		static const Field TranscodeFormatField;
 		static const Field TranscodeBitrateField;
+		static const Field PasswordOldField;
 		static const Field PasswordField;
 		static const Field PasswordConfirmField;
 
-		SettingsModel()
-			: Wt::WFormModel()
+		SettingsModel(bool withOldPassword)
+			: _withOldPassword {withOldPassword}
 		{
 			initializeModels();
 
 			addField(TranscodeEnableField);
 			addField(TranscodeBitrateField);
 			addField(TranscodeFormatField);
+
+			if (_withOldPassword)
+				addField(PasswordOldField);
+
 			addField(PasswordField);
 			addField(PasswordConfirmField);
 
@@ -92,7 +97,10 @@ class SettingsModel : public Wt::WFormModel
 				user.modify()->setAudioTranscodeFormat(_transcodeFormatModel->getValue(*transcodeFormatRow));
 
 			if (!valueText(PasswordField).empty())
+			{
 				user.modify()->setPasswordHash(passwordHash);
+				user.modify()->clearAuthTokens();
+			}
 		}
 
 		void loadData()
@@ -121,7 +129,35 @@ class SettingsModel : public Wt::WFormModel
 		{
 			Wt::WString error;
 
-			if (field == PasswordField)
+			if (field == PasswordOldField)
+			{
+				if (!valueText(PasswordOldField).empty())
+				{
+					switch (getService<::Auth::PasswordService>()->checkUserPassword(
+							LmsApp->getDbSession(),
+							boost::asio::ip::address::from_string(LmsApp->environment().clientAddress()),
+							LmsApp->getUserLoginName(),
+							valueText(PasswordOldField).toUTF8()))
+					{
+						case ::Auth::PasswordService::PasswordCheckResult::Match:
+							break;
+						case ::Auth::PasswordService::PasswordCheckResult::Mismatch:
+							error = Wt::WString::tr("Lms.Settings.password-bad");
+							break;
+						case ::Auth::PasswordService::PasswordCheckResult::Throttled:
+							error = Wt::WString::tr("Lms.password-client-throttled");
+							break;
+					}
+				}
+				else
+				{
+					if (!valueText(PasswordField).empty())
+						error = Wt::WString::tr("Lms.Settings.password-must-fill-old-password");
+					else
+						return Wt::WFormModel::validateField(field);
+				}
+			}
+			else if (field == PasswordField)
 			{
 				if (!valueText(PasswordField).empty())
 				{
@@ -129,7 +165,12 @@ class SettingsModel : public Wt::WFormModel
 						error = Wt::WString::tr("Lms.password-too-weak");
 				}
 				else
-					return Wt::WFormModel::validateField(field);
+				{
+					if (!valueText(PasswordOldField).empty())
+						error = Wt::WString::tr("Wt.WValidator.Invalid");
+					else
+						return Wt::WFormModel::validateField(field);
+				}
 			}
 			else if (field == PasswordConfirmField)
 			{
@@ -175,14 +216,16 @@ class SettingsModel : public Wt::WFormModel
 			_transcodeFormatModel->add(Wt::WString::tr("Lms.Settings.transcoding.webm_vorbis"), AudioFormat::WEBM_VORBIS);
 		}
 
+		bool _withOldPassword {};
+
 		std::shared_ptr<ValueStringModel<Bitrate>>	_transcodeBitrateModel;
 		std::shared_ptr<ValueStringModel<AudioFormat>>	_transcodeFormatModel;
-
 };
 
 const Wt::WFormModel::Field SettingsModel::TranscodeEnableField		= "transcoding-enable";
 const Wt::WFormModel::Field SettingsModel::TranscodeBitrateField	= "transcoding-bitrate";
 const Wt::WFormModel::Field SettingsModel::TranscodeFormatField		= "transcoding-format";
+const Wt::WFormModel::Field SettingsModel::PasswordOldField		= "password-old";
 const Wt::WFormModel::Field SettingsModel::PasswordField		= "password";
 const Wt::WFormModel::Field SettingsModel::PasswordConfirmField		= "password-confirm";
 
@@ -206,7 +249,16 @@ SettingsView::refreshView()
 
 	auto t {addNew<Wt::WTemplateFormView>(Wt::WString::tr("Lms.Settings.template"))};
 
-	auto model {std::make_shared<SettingsModel>()};
+	auto model {std::make_shared<SettingsModel>(!LmsApp->isUserAuthStrong())};
+
+	// Old password
+	if (!LmsApp->isUserAuthStrong())
+	{
+		t->setCondition("if-has-old-password", true);
+		auto oldPassword {std::make_unique<Wt::WLineEdit>()};
+		oldPassword->setEchoMode(Wt::EchoMode::Password);
+		t->setFormWidget(SettingsModel::PasswordOldField, std::move(oldPassword));
+	}
 
 	// Password
 	auto password {std::make_unique<Wt::WLineEdit>()};