diff --git a/main/manager-api/pom.xml b/main/manager-api/pom.xml
index eacbdff9..a1c249a7 100644
--- a/main/manager-api/pom.xml
+++ b/main/manager-api/pom.xml
@@ -168,6 +168,10 @@
             <artifactId>lombok</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
     </dependencies>
 
     <!-- 阿里云maven仓库 -->
diff --git a/main/manager-api/src/main/java/xiaozhi/common/utils/HttpContextUtils.java b/main/manager-api/src/main/java/xiaozhi/common/utils/HttpContextUtils.java
index 3629d553..efa320a8 100644
--- a/main/manager-api/src/main/java/xiaozhi/common/utils/HttpContextUtils.java
+++ b/main/manager-api/src/main/java/xiaozhi/common/utils/HttpContextUtils.java
@@ -8,6 +8,8 @@ import org.springframework.util.DigestUtils;
 import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
+import xiaozhi.common.exception.ErrorCode;
+import xiaozhi.common.exception.RenException;
 
 import java.util.Date;
 import java.util.Enumeration;
@@ -41,6 +43,17 @@ public class HttpContextUtils {
         return token;
     }
 
+    public static String getToken(String authorization) {
+        String token;
+        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+        token = authorization.replace("Bearer ", "");
+        if (StringUtils.isBlank(token)) {
+            throw new RenException(ErrorCode.TOKEN_NOT_EMPTY);
+        }
+        return token;
+    }
     public static Map<String, String> getParameterMap(HttpServletRequest request) {
         Enumeration<String> parameters = request.getParameterNames();
 
diff --git a/main/manager-api/src/main/java/xiaozhi/common/utils/Result.java b/main/manager-api/src/main/java/xiaozhi/common/utils/Result.java
index c21bdbf9..89999420 100644
--- a/main/manager-api/src/main/java/xiaozhi/common/utils/Result.java
+++ b/main/manager-api/src/main/java/xiaozhi/common/utils/Result.java
@@ -37,6 +37,11 @@ public class Result<T> implements Serializable {
     @Schema(description = "响应数据")
     private T data;
 
+    public Result<T> ok() {
+        this.setCode(0);
+        return this;
+    }
+
     public Result<T> ok(T data) {
         this.setData(data);
         return this;
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java b/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java
index 1974689c..d458e9f9 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java
@@ -25,11 +25,10 @@ import xiaozhi.modules.security.user.SecurityUser;
 import java.util.List;
 import java.util.Map;
 
+@Tag(name = "设备管理")
 @AllArgsConstructor
 @RestController
 @RequestMapping("/device")
-@Tag(name = "设备管理")
-
 public class DeviceController {
     private final DeviceService deviceService;
     private final RedisUtils redisUtils;
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java b/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
index af3f451c..130ef27f 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
@@ -4,20 +4,20 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.AllArgsConstructor;
-import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.exception.RenException;
 import xiaozhi.common.page.TokenDTO;
+import xiaozhi.common.utils.HttpContextUtils;
 import xiaozhi.common.utils.Result;
 import xiaozhi.common.validator.AssertUtils;
-import xiaozhi.modules.security.dao.SysUserTokenDao;
 import xiaozhi.modules.security.dto.LoginDTO;
 import xiaozhi.modules.security.password.PasswordUtils;
 import xiaozhi.modules.security.service.CaptchaService;
 import xiaozhi.modules.security.service.SysUserTokenService;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.service.SysUserService;
 
@@ -26,7 +26,6 @@ import java.io.IOException;
 /**
  * 登录控制层
  */
-@Tag(name = "登录管理")
 @AllArgsConstructor
 @RestController
 @RequestMapping("/user")
@@ -92,19 +91,23 @@ public class LoginController {
 
     @GetMapping("/info")
     @Operation(summary = "用户信息获取")
-    public Result<SysUserDTO> info(@RequestHeader("Authorization")String authorization) {
+    public Result info(@RequestHeader("Authorization")String authorization) {
         logger.info("the authorization:{}", authorization);
 
-        String token;
-        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
-            throw new RenException(ErrorCode.UNAUTHORIZED);
-        }
-        token = authorization.replace("Bearer ", "");
-        if (StringUtils.isBlank(token)) {
-            throw new RenException(ErrorCode.UNAUTHORIZED);
-        }
+        String token = HttpContextUtils.getToken(authorization);
         SysUserDTO sysUserDTO = sysUserTokenService.getUserByToken(token);
-        Result result = new Result<SysUserDTO>();
+        Result<SysUserDTO> result = new Result<>();
         return result.ok(sysUserDTO);
     }
+
+    @PutMapping("/change-password")
+    @Operation(summary = "修改用户密码")
+    public Result<?> changePassword(@RequestHeader("Authorization")String authorization,
+                                    @RequestBody PasswordDTO passwordDTO) {
+
+        String token = HttpContextUtils.getToken(authorization);
+        sysUserTokenService.changePassword(token, passwordDTO);
+
+        return new Result<>().ok();
+    }
 }
\ No newline at end of file
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java b/main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java
index 74882dea..6cfef3ec 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java
@@ -5,6 +5,7 @@ import xiaozhi.common.page.TokenDTO;
 import xiaozhi.common.service.BaseService;
 import xiaozhi.common.utils.Result;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 
 import java.util.Map;
@@ -32,4 +33,6 @@ public interface SysUserTokenService extends BaseService<SysUserTokenEntity> {
      */
     void logout(Long userId);
 
+    void changePassword(String token, PasswordDTO passwordDTO);
+
 }
\ No newline at end of file
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java b/main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java
index caa24801..c2aaeecc 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java
@@ -13,6 +13,7 @@ import xiaozhi.modules.security.entity.SysUserTokenEntity;
 import xiaozhi.modules.security.oauth2.TokenGenerator;
 import xiaozhi.modules.security.service.SysUserTokenService;
 import org.springframework.stereotype.Service;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.service.SysUserService;
 
@@ -81,6 +82,9 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
     @Override
     public SysUserDTO getUserByToken(String token) {
         SysUserTokenEntity userToken = baseDao.getByToken(token);
+        if (null == userToken) {
+            throw new RenException(ErrorCode.TOKEN_INVALID);
+        }
 
         Date now = new Date();
         if (userToken.getExpireDate().before(now)) {
@@ -97,4 +101,23 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
         Date expireDate = DateUtil.offsetMinute(new Date(), -1);
         baseDao.logout(userId, expireDate);
     }
+
+    @Override
+    public void changePassword(String token, PasswordDTO passwordDTO) {
+        SysUserTokenEntity userToken = baseDao.getByToken(token);
+        if (null == userToken) {
+            throw new RenException(ErrorCode.TOKEN_INVALID);
+        }
+        Date now = new Date();
+        if (userToken.getExpireDate().before(now)) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+
+        // 修改密码
+        sysUserService.changePassword(userToken.getUserId(), passwordDTO);
+
+        // 使 token 失效，后需要重新登录
+        Date expireDate = DateUtil.offsetMinute(now, -1);
+        baseDao.logout(userToken.getUserId(), expireDate);
+    }
 }
\ No newline at end of file
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java b/main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java
index 5f01861f..08179409 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java
@@ -1,6 +1,7 @@
 package xiaozhi.modules.sys.service;
 
 import xiaozhi.common.service.BaseService;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.entity.SysUserEntity;
 
@@ -18,4 +19,5 @@ public interface SysUserService extends BaseService<SysUserEntity> {
 
     void delete(Long[] ids);
 
+    void changePassword(Long userId, PasswordDTO passwordDTO);
 }
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java b/main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java
index 8f576137..17d1939c 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java
@@ -10,6 +10,7 @@ import xiaozhi.common.service.impl.BaseServiceImpl;
 import xiaozhi.common.utils.ConvertUtils;
 import xiaozhi.modules.security.password.PasswordUtils;
 import xiaozhi.modules.sys.dao.SysUserDao;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.entity.SysUserEntity;
 import xiaozhi.modules.sys.enums.SuperAdminEnum;
@@ -81,6 +82,31 @@ public class SysUserServiceImpl extends BaseServiceImpl<SysUserDao, SysUserEntit
         baseDao.deleteBatchIds(Arrays.asList(ids));
     }
 
+    @Override
+    public void changePassword(Long userId, PasswordDTO passwordDTO) {
+        SysUserEntity sysUserEntity = sysUserDao.selectById(userId);
+
+        if (null == sysUserEntity) {
+            throw new RenException(ErrorCode.TOKEN_INVALID);
+        }
+
+        // 判断旧密码是否正确
+        if (!PasswordUtils.matches(passwordDTO.getPassword(), sysUserEntity.getPassword())) {
+            throw new RenException("旧密码输入错误");
+        }
+
+        //新密码强度
+        if (!isStrongPassword(passwordDTO.getNewPassword())) {
+            throw new RenException(ErrorCode.PASSWORD_WEAK_ERROR);
+        }
+
+        //密码加密
+        String password = PasswordUtils.encode(passwordDTO.getNewPassword());
+        sysUserEntity.setPassword(password);
+
+        updateById(sysUserEntity);
+    }
+
     private Long getUserCount() {
         QueryWrapper<SysUserEntity> queryWrapper = new QueryWrapper<>();
         return baseDao.selectCount(queryWrapper);