diff --git a/service.go b/service.go
index fc3773e..4e73873 100644
--- a/service.go
+++ b/service.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/google/shlex"
+	"golang.org/x/crypto/bcrypt"
 	"gopkg.in/irc.v3"
 )
 
@@ -118,6 +119,11 @@ func init() {
 				},
 			},
 		},
+		"change-password": {
+			usage:  "<new password>",
+			desc:   "change your password",
+			handle: handlePasswordChange,
+		},
 	}
 }
 
@@ -254,3 +260,20 @@ func handleServiceNetworkDelete(dc *downstreamConn, params []string) error {
 	sendServicePRIVMSG(dc, fmt.Sprintf("deleted network %q", net.GetName()))
 	return nil
 }
+
+func handlePasswordChange(dc *downstreamConn, params []string) error {
+	if len(params) != 1 {
+		return fmt.Errorf("expected exactly one argument")
+	}
+
+	hashed, err := bcrypt.GenerateFromPassword([]byte(params[0]), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("failed to hash password: %v", err)
+	}
+	if err := dc.user.updatePassword(string(hashed)); err != nil {
+		return err
+	}
+
+	sendServicePRIVMSG(dc, "password updated")
+	return nil
+}
diff --git a/user.go b/user.go
index 018009b..36702bf 100644
--- a/user.go
+++ b/user.go
@@ -369,3 +369,8 @@ func (u *user) deleteNetwork(id int64) error {
 
 	panic("tried deleting a non-existing network")
 }
+
+func (u *user) updatePassword(hashed string) error {
+	u.User.Password = hashed
+	return u.srv.db.UpdatePassword(&u.User)
+}