--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -18,4 +18,25 @@ class AccountsController < ApplicationController
       render :action => "edit"
     end
   end
+  
+  def password
+    @user = current_user
+  end
+  
+  def update_password
+    @user = current_user
+    if User.authenticate(current_user.email, params[:user][:current_password])
+      @user.password = params[:user][:password]
+      @user.password_confirmation = params[:user][:password_confirmation]
+      if @user.save
+        flash[:notice] = "Your password has been changed"
+        redirect_to account_path
+      else
+        render :action => "password"
+      end
+    else
+      flash[:error] = "Your current password doesn't seem to match the one your supplied"
+      render :action => "password"
+    end
+  end
 end

--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -8,7 +8,7 @@ class User < ActiveRecord::Base
   has_many :comments
   
   # Virtual attribute for the unencrypted password
-  attr_accessor :password
+  attr_accessor :password, :current_password
   
   attr_protected :login
 

--- a/app/views/accounts/edit.html.erb
+++ b/app/views/accounts/edit.html.erb
@@ -14,19 +14,12 @@
     <%= f.label :url, "url <small>blog etc</small>" -%><br />
     <%= f.text_field :url, :class => "text" -%>
   </p>
-  <p>    
-    <%= f.label :password -%><br />
-    <%= f.password_field :password, :class => "text" -%>
-  </p>   
-  <p>    
-    <%= f.label :password_confirmation -%><br />
-    <%= f.password_field :password_confirmation, :class => "text" -%>
-  </p>
   <%= f.submit "Save" -%>
 <% end -%>
 
 <% content_for :submenu do -%>
   <ul>
     <li><%= link_to "&#x2190; My account", account_path -%></li>
+    <li><%= link_to "&#x2192; Change password", password_account_path -%></li>
   </ul>
 <% end -%>
\ No newline at end of file

--- /dev/null
+++ b/app/views/accounts/password.html.erb
@@ -0,0 +1,25 @@
+<h1>Edit your account</h1>
+<%= error_messages_for :user -%>
+
+<% form_for @user, :url => update_password_account_path, :method => :put do |f| -%>
+  <p>
+    <%= f.label :current_password -%><br />
+    <%= f.password_field :current_password, :class => "text" -%>
+  </p>
+  <p>
+    <%= f.label :password, "New password" -%><br />
+    <%= f.password_field :password, :class => "text" -%>
+  </p>   
+  <p>    
+    <%= f.label :password_confirmation, "New password confirmation" -%><br />
+    <%= f.password_field :password_confirmation, :class => "text" -%>
+  </p>
+  <%= f.submit "Change password" -%>
+<% end -%>
+
+<% content_for :submenu do -%>
+  <ul>
+    <li><%= link_to "&#x2190; My account", account_path -%></li>
+    <li><%= link_to "&#x2190; Edit details", edit_account_path -%></li>
+  </ul>
+<% end -%>
\ No newline at end of file

--- a/config/routes.rb
+++ b/config/routes.rb
@@ -20,7 +20,7 @@ ActionController::Routing::Routes.draw do |map|
   
   map.root :controller => "site", :action => "index"
   
-  map.resource :account do |account|
+  map.resource :account, :member => {:password => :get, :update_password => :put} do |account|
     account.resources :keys
   end
   map.resources :users 

--- a/spec/controllers/accounts_controller_spec.rb
+++ b/spec/controllers/accounts_controller_spec.rb
@@ -27,7 +27,34 @@ describe AccountsController do
     put :update, :user => {:password => "fubar", :password_confirmation => "fubar"}
     flash[:notice].should_not be(nil)
     response.should redirect_to(account_path)
+  end
+  
+  it "GET /account/password is a-ok" do
+    get :password
+    response.should be_success
+    assigns[:user].should == users(:johan)
+  end
+  
+  it "PUT /account/update_password updates password if old one matches" do
+    put :update_password, :user => {
+      :current_password => "test", 
+      :password => "fubar",
+      :password_confirmation => "fubar" }
+    response.should redirect_to(account_path)
+    flash[:notice].should match(/Your password has been changed/i)
     User.authenticate(users(:johan).email, "fubar").should == users(:johan)
   end
+  
+  it "PUT /account/update_password does not update password if old one is wrong" do
+    put :update_password, :user => {
+      :current_password => "notthecurrentpassword", 
+      :password => "fubar",
+      :password_confirmation => "fubar" }
+    flash[:notice].should == nil
+    flash[:error].should match(/doesn't seem to match/)
+    response.should render_template("accounts/password")
+    User.authenticate(users(:johan).email, "test").should == users(:johan)
+    User.authenticate(users(:johan).email, "fubar").should == nil
+  end
 
 end