How to Let Users Change Their Password
Give users a front-end way to change their password, protected by their current password and an optional strength requirement.
A page with a Profile Edit Form module already in place. See How to Build a Profile Edit Page.
1. Add the Change Password field
Open the Profile Edit Form module settings. On the General tab, add a field and set Field to Change Password. On the form it renders as "New password (leave blank to leave unchanged)".
2. Enable the strength indicator
In the field's settings, set Show strength indicator to Yes and pick a Minimum password strength level. Strong is the default. The indicator uses WordPress's standard strength meter, and the form blocks saving until the new password meets the minimum.
3. Add a confirmation field
Set Show confirmation field to Yes so users must type the new password twice. The form rejects the save if the two entries do not match.
4. Require the current password
Add the Current password field to the form. The save is rejected if the current password entered is wrong, which prevents someone at an unlocked machine from taking over the account.
5. Save and test
Save the module, then test with a real account: leave the password fields blank (profile saves, password unchanged), then set a new password and log back in with it.
Result
Users can change their password from the page. Leaving the field blank keeps the current password; filling it sets the new one after the strength, confirmation, and current-password checks pass.