diff --git a/backend/main.py b/backend/main.py
index 699c5fe..710da20 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -1140,7 +1140,7 @@ def api_forgot_password(
     return reset_password(data.email)
 
 @app.get(
-    "/update-password",
+    "/update-password_page",
     response_class=HTMLResponse,
 )
 def update_password_page(token: str = Query(...)):
@@ -1180,6 +1180,64 @@ def update_password_page(token: str = Query(...)):
     </html>
     """
 
+@app.post(
+    "/update-password",
+    response_class=HTMLResponse,
+)
+def update_password(
+    token: str = Form(...),
+    new_password: str = Form(...),
+):
+    result = reset_password_with_token(
+        token,
+        new_password,
+    )
+
+    if result["status"] == "failed":
+        if result["reason"] == "token_expired":
+            return """
+            <!DOCTYPE html>
+            <html lang="en">
+            <head>
+                <meta charset="UTF-8">
+                <title>Reset expired</title>
+            </head>
+            <body>
+                <h1>Reset link expired</h1>
+                <p>This password reset link has expired.</p>
+            </body>
+            </html>
+            """
+
+        return """
+        <!DOCTYPE html>
+        <html lang="en">
+        <head>
+            <meta charset="UTF-8">
+            <title>Reset failed</title>
+        </head>
+        <body>
+            <h1>Reset failed</h1>
+            <p>This password reset link is invalid.</p>
+            </body>
+        </html>
+        """
+
+    return """
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <title>Password updated</title>
+    </head>
+    <body>
+        <h1>Password updated</h1>
+        <p>Your password has been successfully changed.</p>
+        <p>You may now close this tab.</p>
+    </body>
+    </html>
+    """
+
 # easter egg
 
 @app.get(
