Well-Known Change Password: I Tested 40 Sites, 11 Actually Work

There is a shortcut almost nobody knows about. Add /.well-known/change-password to any website's address, and you are supposed to land directly on that site's change-password form. No hunting through account settings, no three-level menu.

It is a real standard, and it exists mainly so your password manager can offer you a Change password button that actually goes somewhere.

So I measured how many major sites honour it. On 2026-08-24, I probed 40 well-known domains, one request each, following redirects. The raw data and method are published as an open dataset with a DOI: 10.5281/zenodo.22084121. You can rerun the whole thing with curl in a few minutes.

Here is what came back.

The result: 11 out of 40

11   redirect to a real password page
24   return nothing at all (404 / 403)
 5   look like support without being it

The eleven that work: 1Password, Adobe, Airbnb, Apple, Facebook, GitHub, Netflix, Notion, Reddit, WordPress.com, X.

The twenty-four with nothing there include names you would expect to do better: Google, Microsoft, PayPal, Dropbox, eBay, Slack, Spotify, Stripe, Shopify, Cloudflare, GitLab, Zoom, Salesforce, Booking.com.

The five that look like they work

This is the part worth your attention, because it is invisible unless you actually open the page.

Keeper answers HTTP 200 and shows you its own 404. The URL keepersecurity.com/.well-known/change-password redirects to keepersecurity.com/404/, a page titled "The page you requested doesn't exist.", served with a success status code. Any tool checking only the status code concludes the shortcut works. A human clicking the button lands on a dead end.

Proton redirects to the wrong document. protonmail.com/.well-known/change-password sends you to /.well-known/security.txt, which is a different well-known URI entirely: it lists security contact details, not a password form.

LinkedIn answers 200 with a reCAPTCHA challenge page. Twitch answers 200 with its generic 194 KB application shell. Amazon returned a 503 at the moment of measurement.

Count by status code alone and you get 16 working sites. Open the pages and the real number is 11. That gap is the whole reason this measurement was worth doing.

Checking this yourself takes one browser window: type the address, add the path, press enter, and look at where you actually land.

The uncomfortable finding: password managers

Of the six password managers I probed, one works.

1Password          works
Bitwarden          nothing at that URL
Dashlane           nothing at that URL
LastPass           nothing at that URL
NordPass           nothing at that URL
Keeper             HTTP 200, own 404 page

The shortcut exists so that a password manager can send you straight to a site's form. Five of the six tools built to consume it do not publish it on their own site.

That is not a security hole, and it will not leak your vault. It is a small sign of how much attention a vendor pays to the plumbing that makes password hygiene painless rather than tedious. Changing a password is the one thing you do after a breach, in a hurry, usually annoyed. Every extra click is a reason to postpone it.

A note on what this article does not do. PwdFortress runs affiliate links, and the honest reading of this measurement does not support one. The only manager that publishes the shortcut is 1Password, which we have no partnership with; the manager we do partner with returns nothing at that URL. Putting a recommendation here would contradict the table above it. The data goes out as measured.

How to check any site in ten seconds

Type the site's address, add /.well-known/change-password, press enter.

• You land on a password or security settings page: it works.
• You get a 404, the home page, or an error: it does not.

From a terminal, this prints both the status code and where you ended up:

curl -sL -o /dev/null -w '%{http_code} %{url_effective}\n' https://example.com/.well-known/change-password

Watch for the case above: a 200 that lands on something that is not a password form. The status code and the destination have to agree.

What this measurement does not say

One measurement, one vantage point, one date: 2026-08-24. Sites A/B test, route by region, and block automated requests. Seven of the forty refused my request outright, and I recorded those separately rather than counting them as failures, because "this site has no shortcut" and "this site would not answer me" are two different facts and only one of them is about the site.

I also probed apex domains only. A site publishing the shortcut solely on a regional or www host would read as absent here.

If a vendor has fixed theirs since, the dataset carries its date, and rerunning it is a three-minute job.