diff --git a/server/internal/api/auth.go b/server/internal/api/auth.go
index 817a052..2aafbdc 100644
--- a/server/internal/api/auth.go
+++ b/server/internal/api/auth.go
@@ -158,6 +158,36 @@ func (h *Handler) Logout(c *gin.Context) {
 	resp.OK(c, gin.H{"ok": true})
 }
 
+type changePasswordReq struct {
+	OldPassword string `json:"old_password" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required,min=8,max=72"`
+}
+
+// ChangePassword POST /api/v1/auth/password — 修改密码。
+func (h *Handler) ChangePassword(c *gin.Context) {
+	u := sessionUser(c)
+	var req changePasswordReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		resp.Fail(c, http.StatusBadRequest, "invalid input: "+err.Error())
+		return
+	}
+	ok, err := h.a.Hasher.VerifyPassword(u.PasswordHash, req.OldPassword)
+	if err != nil || !ok {
+		resp.Fail(c, http.StatusBadRequest, "旧密码不正确")
+		return
+	}
+	hash, err := h.a.Hasher.HashPassword(req.NewPassword)
+	if err != nil {
+		resp.Fail(c, http.StatusInternalServerError, "failed to hash password")
+		return
+	}
+	if err := h.a.DB.Model(&store.User{}).Where("id = ?", u.ID).Update("password_hash", hash).Error; err != nil {
+		resp.Fail(c, http.StatusInternalServerError, "failed to update password")
+		return
+	}
+	resp.OK(c, gin.H{"ok": true})
+}
+
 // Me GET /api/v1/auth/me
 func (h *Handler) Me(c *gin.Context) {
 	u := sessionUser(c)
diff --git a/server/internal/api/router.go b/server/internal/api/router.go
index 626f5fa..6d14ef4 100644
--- a/server/internal/api/router.go
+++ b/server/internal/api/router.go
@@ -63,6 +63,7 @@ func NewRouter(a *app.App, gw *proxy.Gateway) *gin.Engine {
 			auth.POST("/login", h.Login)
 			auth.POST("/refresh", h.Refresh)
 			auth.POST("/logout", h.Logout)
+			auth.POST("/password", middleware.SessionAuth(a), h.ChangePassword)
 			auth.GET("/me", middleware.SessionAuth(a), h.Me)
 		}
 
diff --git a/web/src/views/console/SettingsView.vue b/web/src/views/console/SettingsView.vue
new file mode 100644
index 0000000..14d9e1f
--- /dev/null
+++ b/web/src/views/console/SettingsView.vue
@@ -0,0 +1,84 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+import { http, errMsg } from '@/api/client'
+import { useAuthStore } from '@/stores/auth'
+import { useToastStore } from '@/stores/toast'
+import { fmtMoney, fmtTime } from '@/lib/format'
+import Badge from '@/components/ui/Badge.vue'
+import Button from '@/components/ui/Button.vue'
+import Input from '@/components/ui/Input.vue'
+
+const auth = useAuthStore()
+const toast = useToastStore()
+
+const oldPwd = ref('')
+const newPwd = ref('')
+const confirmPwd = ref('')
+const saving = ref(false)
+
+async function changePassword() {
+  if (newPwd.value.length < 8) {
+    toast.err('新密码至少 8 位')
+    return
+  }
+  if (newPwd.value !== confirmPwd.value) {
+    toast.err('两次输入的新密码不一致')
+    return
+  }
+  saving.value = true
+  try {
+    await http.post('/auth/password', { old_password: oldPwd.value, new_password: newPwd.value })
+    toast.ok('密码已更新')
+    oldPwd.value = newPwd.value = confirmPwd.value = ''
+  } catch (e) {
+    toast.err(errMsg(e))
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <div class="mx-auto max-w-2xl space-y-6">
+    <div class="mb-2">
+      <h1 class="text-lg font-semibold">账户设置</h1>
+      <p class="text-sm text-muted">个人资料与安全</p>
+    </div>
+
+    <div class="card p-5">
+      <h2 class="mb-4 text-sm font-semibold">个人资料</h2>
+      <dl class="grid grid-cols-2 gap-x-6 gap-y-4 text-sm">
+        <div>
+          <dt class="text-xs text-muted">用户名</dt>
+          <dd class="mt-1 text-ink">{{ auth.user?.username }}</dd>
+        </div>
+        <div>
+          <dt class="text-xs text-muted">邮箱</dt>
+          <dd class="mt-1 font-mono text-xs text-ink">{{ auth.user?.email }}</dd>
+        </div>
+        <div>
+          <dt class="text-xs text-muted">角色</dt>
+          <dd class="mt-1"><Badge :variant="auth.isAdmin ? 'accent' : 'neutral'">{{ auth.user?.role }}</Badge></dd>
+        </div>
+        <div>
+          <dt class="text-xs text-muted">余额</dt>
+          <dd class="mono-num mt-1 text-accent">{{ fmtMoney(auth.user?.balance ?? 0) }}</dd>
+        </div>
+        <div>
+          <dt class="text-xs text-muted">注册时间</dt>
+          <dd class="mono-num mt-1 text-xs text-muted">{{ fmtTime(auth.user?.created_at) }}</dd>
+        </div>
+      </dl>
+    </div>
+
+    <div class="card p-5">
+      <h2 class="mb-4 text-sm font-semibold">修改密码</h2>
+      <div class="max-w-sm space-y-4">
+        <Input v-model="oldPwd" label="当前密码" type="password" autocomplete="current-password" />
+        <Input v-model="newPwd" label="新密码" type="password" autocomplete="new-password" hint="至少 8 位" />
+        <Input v-model="confirmPwd" label="确认新密码" type="password" autocomplete="new-password" />
+        <Button :loading="saving" @click="changePassword">更新密码</Button>
+      </div>
+    </div>
+  </div>
+</template>