diff --git a/lenticular_cloud/cli.py b/lenticular_cloud/cli.py
index 9ce894b..2bcf48e 100644
--- a/lenticular_cloud/cli.py
+++ b/lenticular_cloud/cli.py
@@ -7,6 +7,7 @@ from flask_migrate import upgrade
 from pathlib import Path
 from flask import Flask
 from uuid import UUID
+from getpass import getpass
 
 import logging
 import os
@@ -22,8 +23,11 @@ def entry_point() -> None:
     parser_user.set_defaults(func=cli_user)
     subparsers_user = parser_user.add_subparsers()
     parser_user_delete = subparsers_user.add_parser('delete')
-    parser_user_delete.add_argument('--id', type=str)
+    parser_user_delete.add_argument('--id', type=str, required=True)
     parser_user_delete.set_defaults(func=cli_user_delete)
+    parser_user_passwd = subparsers_user.add_parser('passwd')
+    parser_user_passwd.add_argument('--id', type=str, required=True)
+    parser_user_passwd.set_defaults(func=cli_user_passwd)
 
     parser_signup = subparsers.add_parser('signup')
     parser_signup.add_argument('--signup_id', type=str)
@@ -76,6 +80,17 @@ def cli_user_delete(args) -> None:
     print(f"user {user.username} - {user.id} deleted")
     pass
 
+def cli_user_passwd(args) -> None:
+    user = User.query.get(UUID(args.id))
+    if user is None:
+        print("user not found")
+        return
+    password = getpass("new password: ")
+    user.change_password(password) 
+    db.session.commit()
+    print(f"user {user.username} - password changed")
+    pass
+
 def cli_signup(args) -> None:
 
     if args.signup_id is not None: