I know this is probably unlikely, but I am doing the diligence anyway.

Is there any way to get the current user password from Drupal before updating it with a new one on the user form (user editing account info)?

When it is updated, I would like to trigger an API call to a remote system and update the account password there, too (authentication happens on an external system). However, the API call requires the old password as well as the new one before it will update it.

Otherwise, I need to lock off any way of updating a password in Drupal from privileged users.

  • the password is stored in a hash (salted to make it harder to guess), so no chance
    – 4uk4
    Commented Jul 5, 2017 at 22:29
  • Yep. Had to ask.
    – Kevin
    Commented Jul 5, 2017 at 22:31
  • But you could to the same as the remote system, ask the user to provide the old password and check it against the stored hash, before allowing a password change.
    – 4uk4
    Commented Jul 5, 2017 at 22:36
  • Yeah, I could do that perhaps. I already augmented the user auth process to authenticate to the external system, even if the account exists in Drupal - if they validate then it overwrites the stored Drupal password and saves anyway. That helps in cases where they change it remotely, then come back... but not if say, an admin goes in and changes a user password.
    – Kevin
    Commented Jul 5, 2017 at 22:38

1 Answer 1


Yes you can. The password only gets hashed when the user entity is saved as part of PasswordItem::preSave().

So you can add a submit handler to the user form, fetch both the old password and the new password (as users are required to enter both usually*) and do what you want with it.

There are discussions about that being insecure, so it is possible that this will change in the future.

  • There are exceptions to this, for example after using a one time login link, users are allowed to change their password without providing the current one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.