diff --git a/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumer.kt b/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumer.kt
index b5876d4f..bb2118b9 100644
--- a/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumer.kt
+++ b/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumer.kt
@@ -3,8 +3,8 @@ package com.vauthenticator.server.account.signup
 import com.vauthenticator.server.events.EventConsumer
 import com.vauthenticator.server.events.SignUpEvent
 import com.vauthenticator.server.events.VAuthenticatorEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import org.springframework.stereotype.Service
 
 @Service
diff --git a/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpUse.kt b/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpUse.kt
index 9c9fee9e..21c44170 100644
--- a/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpUse.kt
+++ b/src/main/kotlin/com/vauthenticator/server/account/signup/SignUpUse.kt
@@ -6,9 +6,9 @@ import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.SignUpEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.role.domain.Role
 import java.time.Instant
 
diff --git a/src/main/kotlin/com/vauthenticator/server/config/ChangePasswordConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/ChangePasswordConfig.kt
index 82dab41c..7039455f 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/ChangePasswordConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/ChangePasswordConfig.kt
@@ -2,9 +2,9 @@ package com.vauthenticator.server.config
 
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
-import com.vauthenticator.server.password.changepassword.ChangePassword
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.changepassword.ChangePassword
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 
diff --git a/src/main/kotlin/com/vauthenticator/server/config/ClientApplicationConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/ClientApplicationConfig.kt
index 2aa0eb06..b6157e0e 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/ClientApplicationConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/ClientApplicationConfig.kt
@@ -9,7 +9,7 @@ import com.vauthenticator.server.oauth2.clientapp.adapter.dynamodb.DynamoDbClien
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientApplicationRepository
 import com.vauthenticator.server.oauth2.clientapp.domain.ReadClientApplication
 import com.vauthenticator.server.oauth2.clientapp.domain.StoreClientApplication
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import org.springframework.beans.factory.annotation.Value
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
 import org.springframework.context.annotation.Bean
diff --git a/src/main/kotlin/com/vauthenticator/server/config/EventsConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/EventsConfig.kt
index b831a487..d9fffe52 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/EventsConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/EventsConfig.kt
@@ -4,8 +4,8 @@ import com.vauthenticator.server.account.emailverification.SendVerifyEMailChalle
 import com.vauthenticator.server.account.signup.SignUpEventConsumer
 import com.vauthenticator.server.account.welcome.SendWelcomeMailUponSignUpEventConsumer
 import com.vauthenticator.server.events.*
-import com.vauthenticator.server.password.changepassword.ChangePasswordEventConsumer
-import com.vauthenticator.server.password.resetpassword.ResetPasswordEventConsumer
+import com.vauthenticator.server.password.domain.changepassword.ChangePasswordEventConsumer
+import com.vauthenticator.server.password.domain.resetpassword.ResetPasswordEventConsumer
 import org.springframework.context.ApplicationEventPublisher
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
diff --git a/src/main/kotlin/com/vauthenticator/server/config/PasswordGeneratorConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/PasswordGeneratorConfig.kt
index c1b231a9..93ee9340 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/PasswordGeneratorConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/PasswordGeneratorConfig.kt
@@ -1,7 +1,7 @@
 package com.vauthenticator.server.config
 
-import com.vauthenticator.server.password.PasswordGenerator
-import com.vauthenticator.server.password.PasswordGeneratorCriteria
+import com.vauthenticator.server.password.domain.PasswordGenerator
+import com.vauthenticator.server.password.domain.PasswordGeneratorCriteria
 import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
diff --git a/src/main/kotlin/com/vauthenticator/server/config/PasswordPolicyConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/PasswordPolicyConfig.kt
index 9c8c8649..77eaa734 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/PasswordPolicyConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/PasswordPolicyConfig.kt
@@ -1,7 +1,9 @@
 package com.vauthenticator.server.config
 
-import com.vauthenticator.server.password.*
+import com.vauthenticator.server.password.adapter.dynamodb.DynamoPasswordHistoryRepository
+import com.vauthenticator.server.password.domain.*
 import org.springframework.beans.factory.annotation.Value
+import org.springframework.boot.context.properties.ConfigurationProperties
 import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
@@ -53,4 +55,12 @@ class PasswordPolicyConfig {
         dynamoPasswordHistoryTableName,
         dynamoDbClient
     )
-}
\ No newline at end of file
+}
+
+
+@ConfigurationProperties(prefix = "password.policy")
+data class PasswordPolicyConfigProp(
+    val minSize: Int,
+    val minSpecialSymbol: Int,
+    val enablePasswordReusePrevention: Boolean
+)
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/config/ResetPasswordConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/ResetPasswordConfig.kt
index 6d2d1df6..50b779ac 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/ResetPasswordConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/ResetPasswordConfig.kt
@@ -11,10 +11,10 @@ import com.vauthenticator.server.communication.domain.EMailType
 import com.vauthenticator.server.communication.domain.SimpleEMailMessageFactory
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientApplicationRepository
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
-import com.vauthenticator.server.password.resetpassword.ResetAccountPassword
-import com.vauthenticator.server.password.resetpassword.SendResetPasswordMailChallenge
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.resetpassword.ResetAccountPassword
+import com.vauthenticator.server.password.domain.resetpassword.SendResetPasswordMailChallenge
 import com.vauthenticator.server.ticket.domain.TicketCreator
 import com.vauthenticator.server.ticket.domain.TicketRepository
 import org.springframework.beans.factory.annotation.Value
diff --git a/src/main/kotlin/com/vauthenticator/server/config/SingUpConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/SingUpConfig.kt
index 91f6b6c7..eb21b254 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/SingUpConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/SingUpConfig.kt
@@ -4,8 +4,8 @@ import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.account.signup.SignUpUse
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientApplicationRepository
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 
diff --git a/src/main/kotlin/com/vauthenticator/server/config/WebSecurityConfig.kt b/src/main/kotlin/com/vauthenticator/server/config/WebSecurityConfig.kt
index 6079ec34..c694b341 100644
--- a/src/main/kotlin/com/vauthenticator/server/config/WebSecurityConfig.kt
+++ b/src/main/kotlin/com/vauthenticator/server/config/WebSecurityConfig.kt
@@ -9,9 +9,9 @@ import com.vauthenticator.server.oauth2.clientapp.domain.ClientApplicationReposi
 import com.vauthenticator.server.oauth2.clientapp.domain.Scope
 import com.vauthenticator.server.oidc.logout.ClearSessionStateLogoutHandler
 import com.vauthenticator.server.oidc.sessionmanagement.SessionManagementFactory
-import com.vauthenticator.server.password.BcryptVAuthenticatorPasswordEncoder
-import com.vauthenticator.server.password.changepassword.CHANGE_PASSWORD_URL
-import com.vauthenticator.server.password.changepassword.ChangePasswordLoginWorkflowHandler
+import com.vauthenticator.server.password.adapter.spring.BcryptVAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.changepassword.CHANGE_PASSWORD_URL
+import com.vauthenticator.server.password.domain.changepassword.ChangePasswordLoginWorkflowHandler
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
diff --git a/src/main/kotlin/com/vauthenticator/server/events/Events.kt b/src/main/kotlin/com/vauthenticator/server/events/Events.kt
index e869c917..ac26a3d8 100644
--- a/src/main/kotlin/com/vauthenticator/server/events/Events.kt
+++ b/src/main/kotlin/com/vauthenticator/server/events/Events.kt
@@ -2,7 +2,7 @@ package com.vauthenticator.server.events
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
+import com.vauthenticator.server.password.domain.Password
 import org.springframework.boot.context.properties.ConfigurationProperties
 import org.springframework.security.authentication.event.AbstractAuthenticationEvent
 import java.time.Instant
@@ -54,7 +54,8 @@ class SignUpEvent(
     userName: Email,
     clientAppId: ClientAppId,
     timeStamp: Instant,
-    password : Password) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
+    password : Password
+) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
     override fun equals(other: Any?): Boolean {
         if (this === other) return true
         if (javaClass != other?.javaClass) return false
@@ -70,7 +71,8 @@ class ChangePasswordEvent(
     userName: Email,
     clientAppId: ClientAppId,
     timeStamp: Instant,
-    password : Password) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
+    password : Password
+) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
     override fun equals(other: Any?): Boolean {
         if (this === other) return true
         if (javaClass != other?.javaClass) return false
@@ -86,7 +88,8 @@ class ResetPasswordEvent(
     userName: Email,
     clientAppId: ClientAppId,
     timeStamp: Instant,
-    password : Password) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
+    password : Password
+) : VAuthenticatorEvent(userName, clientAppId, timeStamp, password) {
     override fun equals(other: Any?): Boolean {
         if (this === other) return true
         if (javaClass != other?.javaClass) return false
diff --git a/src/main/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/ClientApplicationUseCases.kt b/src/main/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/ClientApplicationUseCases.kt
index 80401070..a4d14157 100644
--- a/src/main/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/ClientApplicationUseCases.kt
+++ b/src/main/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/ClientApplicationUseCases.kt
@@ -1,6 +1,6 @@
 package com.vauthenticator.server.oauth2.clientapp.domain
 
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import java.util.*
 
 class StoreClientApplication(private val clientApplicationRepository: ClientApplicationRepository,
diff --git a/src/main/kotlin/com/vauthenticator/server/password/PasswordEncoder.kt b/src/main/kotlin/com/vauthenticator/server/password/PasswordEncoder.kt
deleted file mode 100644
index 1bc3d411..00000000
--- a/src/main/kotlin/com/vauthenticator/server/password/PasswordEncoder.kt
+++ /dev/null
@@ -1,26 +0,0 @@
-package com.vauthenticator.server.password
-
-import org.springframework.security.crypto.password.PasswordEncoder
-
-interface VAuthenticatorPasswordEncoder {
-    fun encode(password: String): String
-
-    fun matches(password: String, encodedPassword: String): Boolean
-}
-
-class BcryptVAuthenticatorPasswordEncoder(private val passwordEncoder: PasswordEncoder) :
-    VAuthenticatorPasswordEncoder {
-
-    override fun encode(password: String): String = passwordEncoder.encode(password)
-    override fun matches(password: String, encodedPassword: String): Boolean =
-        passwordEncoder.matches(password, encodedPassword)
-
-}
-class Argon2PasswordEncoderVAuthenticatorPasswordEncoder(private val passwordEncoder: PasswordEncoder) :
-    VAuthenticatorPasswordEncoder {
-
-    override fun encode(password: String): String = passwordEncoder.encode(password)
-    override fun matches(password: String, encodedPassword: String): Boolean =
-        passwordEncoder.matches(password, encodedPassword)
-
-}
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/PasswordHistoryRepository.kt b/src/main/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepository.kt
similarity index 93%
rename from src/main/kotlin/com/vauthenticator/server/password/PasswordHistoryRepository.kt
rename to src/main/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepository.kt
index db53a641..27c1972a 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/PasswordHistoryRepository.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepository.kt
@@ -1,7 +1,9 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.adapter.dynamodb
 
 import com.vauthenticator.server.extentions.asDynamoAttribute
 import com.vauthenticator.server.extentions.valueAsStringFor
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import software.amazon.awssdk.services.dynamodb.DynamoDbClient
 import software.amazon.awssdk.services.dynamodb.model.AttributeValue
 import software.amazon.awssdk.services.dynamodb.model.DeleteItemRequest
@@ -11,13 +13,6 @@ import java.time.Clock
 import java.time.LocalDateTime
 import java.time.ZoneOffset
 
-interface PasswordHistoryRepository {
-
-    fun store(userName: String, password: Password)
-    fun load(userName: String): List<Password>
-
-}
-
 class DynamoPasswordHistoryRepository(
     private val historyEvaluationLimit: Int,
     private val maxHistoryAllowedSize: Int,
@@ -74,4 +69,4 @@ class DynamoPasswordHistoryRepository(
                 }
         }
     }
-}
+}
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/Argon2PasswordEncoderVAuthenticatorPasswordEncoder.kt b/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/Argon2PasswordEncoderVAuthenticatorPasswordEncoder.kt
new file mode 100644
index 00000000..9404a9b5
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/Argon2PasswordEncoderVAuthenticatorPasswordEncoder.kt
@@ -0,0 +1,13 @@
+package com.vauthenticator.server.password.adapter.spring
+
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
+import org.springframework.security.crypto.password.PasswordEncoder
+
+class Argon2PasswordEncoderVAuthenticatorPasswordEncoder(private val passwordEncoder: PasswordEncoder) :
+    VAuthenticatorPasswordEncoder {
+
+    override fun encode(password: String): String = passwordEncoder.encode(password)
+    override fun matches(password: String, encodedPassword: String): Boolean =
+        passwordEncoder.matches(password, encodedPassword)
+
+}
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/BcryptVAuthenticatorPasswordEncoder.kt b/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/BcryptVAuthenticatorPasswordEncoder.kt
new file mode 100644
index 00000000..24965e34
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/adapter/spring/BcryptVAuthenticatorPasswordEncoder.kt
@@ -0,0 +1,13 @@
+package com.vauthenticator.server.password.adapter.spring
+
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
+import org.springframework.security.crypto.password.PasswordEncoder
+
+class BcryptVAuthenticatorPasswordEncoder(private val passwordEncoder: PasswordEncoder) :
+    VAuthenticatorPasswordEncoder {
+
+    override fun encode(password: String): String = passwordEncoder.encode(password)
+    override fun matches(password: String, encodedPassword: String): Boolean =
+        passwordEncoder.matches(password, encodedPassword)
+
+}
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPoint.kt b/src/main/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPoint.kt
similarity index 80%
rename from src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPoint.kt
rename to src/main/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPoint.kt
index 21169368..13d83194 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPoint.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPoint.kt
@@ -1,7 +1,9 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.api
 
 import com.vauthenticator.server.account.AccountNotFoundException
-import com.vauthenticator.server.password.PasswordPolicyViolation
+import com.vauthenticator.server.password.domain.PasswordPolicyViolation
+import com.vauthenticator.server.password.domain.changepassword.ChangePassword
+import com.vauthenticator.server.password.domain.changepassword.ChangePasswordRequest
 import org.springframework.http.ResponseEntity
 import org.springframework.http.ResponseEntity.internalServerError
 import org.springframework.http.ResponseEntity.noContent
diff --git a/src/main/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPoint.kt b/src/main/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPoint.kt
new file mode 100644
index 00000000..b6b4cd51
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPoint.kt
@@ -0,0 +1,15 @@
+package com.vauthenticator.server.password.api
+
+import com.vauthenticator.server.password.domain.PasswordGenerator
+import org.springframework.http.ResponseEntity
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+class PasswordGeneratorEndPoint(private val passwordGenerator: PasswordGenerator) {
+
+    @PostMapping("/api/password")
+    fun generate() = ResponseEntity.ok(GeneratedPasswordResponse(passwordGenerator.generate()))
+}
+
+data class GeneratedPasswordResponse(val pwd: String)
diff --git a/src/main/kotlin/com/vauthenticator/server/password/api/RestePasswordEndPoint.kt b/src/main/kotlin/com/vauthenticator/server/password/api/RestePasswordEndPoint.kt
new file mode 100644
index 00000000..98eaf00e
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/api/RestePasswordEndPoint.kt
@@ -0,0 +1,42 @@
+package com.vauthenticator.server.password.api
+
+import com.vauthenticator.server.oauth2.clientapp.domain.Scope
+import com.vauthenticator.server.oauth2.clientapp.domain.Scopes
+import com.vauthenticator.server.password.domain.resetpassword.ResetAccountPassword
+import com.vauthenticator.server.password.domain.resetpassword.SendResetPasswordMailChallenge
+import com.vauthenticator.server.role.domain.PermissionValidator
+import com.vauthenticator.server.ticket.domain.TicketId
+import jakarta.servlet.http.HttpSession
+import org.springframework.http.ResponseEntity
+import org.springframework.http.ResponseEntity.noContent
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken
+import org.springframework.web.bind.annotation.*
+
+@RestController
+@SessionAttributes("clientId")
+class ResetPasswordEndPoint(
+    private val permissionValidator: PermissionValidator,
+    private val sendResetPasswordMailChallenge: SendResetPasswordMailChallenge,
+    private val resetAccountPassword: ResetAccountPassword
+) {
+
+    @PutMapping("/api/reset-password-challenge")
+    fun sendVerifyMail(
+        @RequestBody request: Map<String, String>,
+        session: HttpSession,
+        principal: JwtAuthenticationToken?
+    ): ResponseEntity<Unit> {
+        permissionValidator.validate(principal, session, Scopes.from(Scope.RESET_PASSWORD))
+        sendResetPasswordMailChallenge.sendResetPasswordMailFor(request["email"]!!)
+        return noContent().build()
+    }
+
+    @PutMapping("/api/reset-password/{ticket}")
+    fun resetPassword(@PathVariable ticket: String, @RequestBody request: ResetPasswordRequest): ResponseEntity<Unit> {
+        resetAccountPassword.resetPasswordFromMailChallenge(TicketId(ticket), request)
+        return noContent().build()
+    }
+
+}
+
+data class ResetPasswordRequest(val newPassword: String)
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/Password.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/Password.kt
similarity index 51%
rename from src/main/kotlin/com/vauthenticator/server/password/Password.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/Password.kt
index 56a9ab1a..30e70c50 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/Password.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/Password.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.domain
 
 @JvmInline
 value class Password(val content: String)
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordEncoder.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordEncoder.kt
new file mode 100644
index 00000000..5a838851
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordEncoder.kt
@@ -0,0 +1,8 @@
+package com.vauthenticator.server.password.domain
+
+interface VAuthenticatorPasswordEncoder {
+    fun encode(password: String): String
+
+    fun matches(password: String, encodedPassword: String): Boolean
+}
+
diff --git a/src/main/kotlin/com/vauthenticator/server/password/PasswordGenerator.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordGenerator.kt
similarity index 85%
rename from src/main/kotlin/com/vauthenticator/server/password/PasswordGenerator.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/PasswordGenerator.kt
index 516b1e24..43e80d04 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/PasswordGenerator.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordGenerator.kt
@@ -1,9 +1,6 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.domain
 
 import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.http.ResponseEntity
-import org.springframework.web.bind.annotation.PostMapping
-import org.springframework.web.bind.annotation.RestController
 import kotlin.random.Random
 
 @ConfigurationProperties(prefix = "password.generator-criteria")
@@ -53,14 +50,6 @@ class PasswordGenerator(private val passwordGeneratorCriteria: PasswordGenerator
     }
 }
 
-data class GeneratedPasswordResponse(val pwd: String)
-
-@RestController
-class PasswordGeneratorEndPoint(private val passwordGenerator: PasswordGenerator) {
-
-    @PostMapping("/api/password")
-    fun generate() = ResponseEntity.ok(GeneratedPasswordResponse(passwordGenerator.generate()))
-}
 
 val specialCharactersAlphabet = charArrayOf(
     '!',
diff --git a/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordHistoryRepository.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordHistoryRepository.kt
new file mode 100644
index 00000000..cd179cdb
--- /dev/null
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordHistoryRepository.kt
@@ -0,0 +1,9 @@
+package com.vauthenticator.server.password.domain
+
+interface PasswordHistoryRepository {
+
+    fun store(userName: String, password: Password)
+    fun load(userName: String): List<Password>
+
+}
+
diff --git a/src/main/kotlin/com/vauthenticator/server/password/PasswordPolicy.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordPolicy.kt
similarity index 83%
rename from src/main/kotlin/com/vauthenticator/server/password/PasswordPolicy.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/PasswordPolicy.kt
index ed03b5bc..eec321dd 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/PasswordPolicy.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/PasswordPolicy.kt
@@ -1,14 +1,17 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.domain
 
-import org.springframework.boot.context.properties.ConfigurationProperties
-
-interface PasswordPolicy {
+fun interface PasswordPolicy {
 
     fun accept(userName: String, password: String)
 }
 
 class PasswordPolicyViolation(message: String) : RuntimeException(message)
 
+class CompositePasswordPolicy(private val passwordPolicies: Set<PasswordPolicy>) : PasswordPolicy {
+    override fun accept(userName: String, password: String) {
+        passwordPolicies.forEach { it.accept(userName, password) }
+    }
+}
 
 class SpecialCharacterPasswordPolicy(private val minSpecialSymbol: Int) : PasswordPolicy {
     private val pattern = "^[A-Za-z0-9\\s]+".toRegex()
@@ -50,15 +53,3 @@ class ReusePreventionPasswordPolicy(
 }
 
 
-class CompositePasswordPolicy(private val passwordPolicies: Set<PasswordPolicy>) : PasswordPolicy {
-    override fun accept(userName: String, password: String) {
-        passwordPolicies.forEach { it.accept(userName, password) }
-    }
-}
-
-@ConfigurationProperties(prefix = "password.policy")
-data class PasswordPolicyConfigProp(
-    val minSize: Int,
-    val minSpecialSymbol: Int,
-    val enablePasswordReusePrevention: Boolean
-)
\ No newline at end of file
diff --git a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePassword.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePassword.kt
similarity index 89%
rename from src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePassword.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePassword.kt
index 34e378c6..3735a425 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePassword.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePassword.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.account.AccountNotFoundException
 import com.vauthenticator.server.account.Email
@@ -6,9 +6,9 @@ import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.ChangePasswordEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import org.springframework.security.authentication.event.AbstractAuthenticationEvent
 import org.springframework.security.authentication.event.AbstractAuthenticationFailureEvent
 import org.springframework.security.core.Authentication
diff --git a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumer.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumer.kt
similarity index 75%
rename from src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumer.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumer.kt
index 86768584..52c4042e 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumer.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumer.kt
@@ -1,10 +1,10 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.events.ChangePasswordEvent
 import com.vauthenticator.server.events.EventConsumer
 import com.vauthenticator.server.events.VAuthenticatorEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import org.springframework.stereotype.Service
 
 @Service
diff --git a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandler.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandler.kt
similarity index 94%
rename from src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandler.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandler.kt
index 3c88d19d..9fcd63df 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandler.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandler.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.account.AccountMandatoryAction
 import com.vauthenticator.server.account.repository.AccountRepository
diff --git a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPassword.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPassword.kt
similarity index 86%
rename from src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPassword.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPassword.kt
index d22eb662..dfda1426 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPassword.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPassword.kt
@@ -1,13 +1,14 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.ResetPasswordEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.api.ResetPasswordRequest
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.ticket.domain.InvalidTicketException
 import com.vauthenticator.server.ticket.domain.Ticket
 import com.vauthenticator.server.ticket.domain.TicketId
diff --git a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumer.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumer.kt
similarity index 75%
rename from src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumer.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumer.kt
index b08b0083..336fa2a7 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumer.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumer.kt
@@ -1,10 +1,10 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.events.EventConsumer
 import com.vauthenticator.server.events.ResetPasswordEvent
 import com.vauthenticator.server.events.VAuthenticatorEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import org.springframework.stereotype.Service
 
 @Service
diff --git a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallenge.kt b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallenge.kt
similarity index 93%
rename from src/main/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallenge.kt
rename to src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallenge.kt
index 7e3838a4..ec4f0ddc 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallenge.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallenge.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.communication.domain.EMailSenderService
diff --git a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordController.kt b/src/main/kotlin/com/vauthenticator/server/password/web/ChangePasswordController.kt
similarity index 96%
rename from src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordController.kt
rename to src/main/kotlin/com/vauthenticator/server/password/web/ChangePasswordController.kt
index 7f7286e3..a8e59880 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordController.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/web/ChangePasswordController.kt
@@ -1,9 +1,10 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.web
 
 import com.vauthenticator.server.account.AccountMandatoryAction
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.i18n.I18nMessageInjector
 import com.vauthenticator.server.i18n.I18nScope
+import com.vauthenticator.server.password.domain.changepassword.*
 import jakarta.servlet.http.HttpServletRequest
 import jakarta.servlet.http.HttpServletResponse
 import org.slf4j.LoggerFactory
diff --git a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/RestePasswordEndPoint.kt b/src/main/kotlin/com/vauthenticator/server/password/web/ResetPasswordController.kt
similarity index 52%
rename from src/main/kotlin/com/vauthenticator/server/password/resetpassword/RestePasswordEndPoint.kt
rename to src/main/kotlin/com/vauthenticator/server/password/web/ResetPasswordController.kt
index 29f8152a..f6bddbc4 100644
--- a/src/main/kotlin/com/vauthenticator/server/password/resetpassword/RestePasswordEndPoint.kt
+++ b/src/main/kotlin/com/vauthenticator/server/password/web/ResetPasswordController.kt
@@ -1,46 +1,12 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.web
 
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.vauthenticator.server.i18n.I18nMessageInjector
 import com.vauthenticator.server.i18n.I18nScope
-import com.vauthenticator.server.oauth2.clientapp.domain.Scope
-import com.vauthenticator.server.oauth2.clientapp.domain.Scopes
-import com.vauthenticator.server.role.domain.PermissionValidator
-import com.vauthenticator.server.ticket.domain.TicketId
-import jakarta.servlet.http.HttpSession
-import org.springframework.http.ResponseEntity
-import org.springframework.http.ResponseEntity.noContent
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken
 import org.springframework.stereotype.Controller
 import org.springframework.ui.Model
-import org.springframework.web.bind.annotation.*
-
-@RestController
-@SessionAttributes("clientId")
-class ResetPasswordEndPoint(
-    private val permissionValidator: PermissionValidator,
-    private val sendResetPasswordMailChallenge: SendResetPasswordMailChallenge,
-    private val resetAccountPassword: ResetAccountPassword
-) {
-
-    @PutMapping("/api/reset-password-challenge")
-    fun sendVerifyMail(
-        @RequestBody request: Map<String, String>,
-        session: HttpSession,
-        principal: JwtAuthenticationToken?
-    ): ResponseEntity<Unit> {
-        permissionValidator.validate(principal, session, Scopes.from(Scope.RESET_PASSWORD))
-        sendResetPasswordMailChallenge.sendResetPasswordMailFor(request["email"]!!)
-        return noContent().build()
-    }
-
-    @PutMapping("/api/reset-password/{ticket}")
-    fun resetPassword(@PathVariable ticket: String, @RequestBody request: ResetPasswordRequest): ResponseEntity<Unit> {
-        resetAccountPassword.resetPasswordFromMailChallenge(TicketId(ticket), request)
-        return noContent().build()
-    }
-
-}
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
 
 @Controller
 class ResetPasswordController(
@@ -54,7 +20,6 @@ class ResetPasswordController(
         model.addAttribute("assetBundle", "resetPasswordChallengeSender_bundle.js")
         return "template"
     }
-
     @GetMapping("/reset-password/successful-reset-password-email-challenge")
     fun successfulResetPasswordMailChallengePage(model: Model): String {
         i18nMessageInjector.setMessagedFor(I18nScope.SUCCESSFUL_RESET_PASSWORD_CHALLENGE_SENDER_PAGE, model)
@@ -78,6 +43,4 @@ class ResetPasswordController(
         model.addAttribute("assetBundle", "successfulPasswordReset_bundle.js")
         return "template"
     }
-}
-
-data class ResetPasswordRequest(val newPassword: String)
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumerTest.kt b/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumerTest.kt
index b4db6dfd..80f2cd7f 100644
--- a/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumerTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpEventConsumerTest.kt
@@ -2,8 +2,8 @@ package com.vauthenticator.server.account.signup
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.events.SignUpEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import com.vauthenticator.server.support.ClientAppFixture
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
diff --git a/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpUseTest.kt b/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpUseTest.kt
index 4d2b8f98..05d092f7 100644
--- a/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpUseTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/account/signup/SignUpUseTest.kt
@@ -5,9 +5,9 @@ import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.SignUpEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.role.domain.Role
 import com.vauthenticator.server.support.AccountTestFixture.anAccount
 import io.mockk.every
diff --git a/src/test/kotlin/com/vauthenticator/server/events/EventFixture.kt b/src/test/kotlin/com/vauthenticator/server/events/EventFixture.kt
index 6c2c74f8..ef7cfc80 100644
--- a/src/test/kotlin/com/vauthenticator/server/events/EventFixture.kt
+++ b/src/test/kotlin/com/vauthenticator/server/events/EventFixture.kt
@@ -2,7 +2,7 @@ package com.vauthenticator.server.events
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
-import com.vauthenticator.server.password.Password
+import com.vauthenticator.server.password.domain.Password
 import com.vauthenticator.server.support.A_CLIENT_APP_ID
 import com.vauthenticator.server.support.ClientAppFixture
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
diff --git a/src/test/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/StoreClientApplicationTest.kt b/src/test/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/StoreClientApplicationTest.kt
index bd935187..e256783c 100644
--- a/src/test/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/StoreClientApplicationTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/oauth2/clientapp/domain/StoreClientApplicationTest.kt
@@ -1,6 +1,6 @@
 package com.vauthenticator.server.oauth2.clientapp.domain
 
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.support.ClientAppFixture
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
diff --git a/src/test/kotlin/com/vauthenticator/server/password/ReusePreventionPasswordPolicyTest.kt b/src/test/kotlin/com/vauthenticator/server/password/ReusePreventionPasswordPolicyTest.kt
deleted file mode 100644
index 13d99abd..00000000
--- a/src/test/kotlin/com/vauthenticator/server/password/ReusePreventionPasswordPolicyTest.kt
+++ /dev/null
@@ -1,4 +0,0 @@
-package com.vauthenticator.server.password
-
-class ReusePreventionPasswordPolicyTest {
-}
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/DynamoPasswordHistoryRepositoryTest.kt b/src/test/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepositoryTest.kt
similarity index 83%
rename from src/test/kotlin/com/vauthenticator/server/password/DynamoPasswordHistoryRepositoryTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepositoryTest.kt
index 018bc209..00456c06 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/DynamoPasswordHistoryRepositoryTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/adapter/dynamodb/DynamoPasswordHistoryRepositoryTest.kt
@@ -1,9 +1,9 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.adapter.dynamodb
 
 import com.vauthenticator.server.extentions.asDynamoAttribute
-import com.vauthenticator.server.support.DynamoDbUtils.dynamoDbClient
-import com.vauthenticator.server.support.DynamoDbUtils.dynamoPasswordHistoryTableName
-import com.vauthenticator.server.support.DynamoDbUtils.resetDynamoDb
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
+import com.vauthenticator.server.support.DynamoDbUtils
 import io.mockk.junit5.MockKExtension
 import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.BeforeEach
@@ -26,11 +26,11 @@ class DynamoPasswordHistoryRepositoryTest {
             2,
             3,
             Clock.systemUTC(),
-            dynamoPasswordHistoryTableName,
-            dynamoDbClient
+            DynamoDbUtils.dynamoPasswordHistoryTableName,
+            DynamoDbUtils.dynamoDbClient
         )
 
-        resetDynamoDb()
+        DynamoDbUtils.resetDynamoDb()
     }
 
     @Test
@@ -61,6 +61,7 @@ class DynamoPasswordHistoryRepositoryTest {
         Assertions.assertEquals(expected, history)
         Assertions.assertEquals(3, loadActualDynamoSizeFor(A_USERNAME).size)
     }
+
     @Test
     fun `when store a new password in an non empty the history with less item then requested as limit`() {
         uut.store(A_USERNAME, Password("A_PASSWORD 3"))
@@ -74,9 +75,9 @@ class DynamoPasswordHistoryRepositoryTest {
     }
 
     private fun loadActualDynamoSizeFor(userName: String): MutableList<MutableMap<String, AttributeValue>> {
-        return dynamoDbClient.query(
+        return DynamoDbUtils.dynamoDbClient.query(
             QueryRequest.builder()
-                .tableName(dynamoPasswordHistoryTableName)
+                .tableName(DynamoDbUtils.dynamoPasswordHistoryTableName)
                 .scanIndexForward(false)
                 .keyConditionExpression("user_name=:email")
                 .expressionAttributeValues(mapOf(":email" to userName.asDynamoAttribute())).build()
diff --git a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPointTest.kt b/src/test/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPointTest.kt
similarity index 75%
rename from src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPointTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPointTest.kt
index d2c7844b..4ce8e085 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEndPointTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/api/ChangePasswordEndPointTest.kt
@@ -1,10 +1,12 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.api
 
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.vauthenticator.server.account.AccountNotFoundException
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
 import com.vauthenticator.server.oauth2.clientapp.domain.Scope
-import com.vauthenticator.server.password.PasswordPolicyViolation
+import com.vauthenticator.server.password.domain.PasswordPolicyViolation
+import com.vauthenticator.server.password.domain.changepassword.ChangePassword
+import com.vauthenticator.server.password.domain.changepassword.ChangePasswordRequest
 import com.vauthenticator.server.support.A_CLIENT_APP_ID
 import com.vauthenticator.server.support.EMAIL
 import com.vauthenticator.server.support.SecurityFixture.principalFor
@@ -25,7 +27,7 @@ import org.springframework.test.web.servlet.result.MockMvcResultMatchers.status
 import org.springframework.test.web.servlet.setup.MockMvcBuilders
 
 @ExtendWith(MockKExtension::class)
-internal class ChangePasswordEndPointTest {
+class ChangePasswordEndPointTest {
     private val objectMapper = ObjectMapper()
 
     lateinit var mokMvc: MockMvc
@@ -37,7 +39,7 @@ internal class ChangePasswordEndPointTest {
     lateinit var changePassword: ChangePassword
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         mokMvc =
             MockMvcBuilders.standaloneSetup(
                 ChangePasswordEndPoint(changePassword)
@@ -46,7 +48,7 @@ internal class ChangePasswordEndPointTest {
     }
 
     @Test
-    internal fun `when a change password attempt is executed`() {
+    fun `when a change password attempt is executed`() {
         val principal = principalFor(
             A_CLIENT_APP_ID,
             EMAIL,
@@ -63,18 +65,24 @@ internal class ChangePasswordEndPointTest {
         )
             .andExpect(status().isNoContent)
 
-        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password"))  }
+        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password")) }
 
     }
+
     @Test
-    internal fun `when a change password for an account not found`() {
+    fun `when a change password for an account not found`() {
         val principal = principalFor(
             A_CLIENT_APP_ID,
             EMAIL,
             listOf(VAUTHENTICATOR_ADMIN),
             listOf(Scope.RESET_PASSWORD.content)
         )
-        every { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password")) } throws AccountNotFoundException("")
+        every {
+            changePassword.resetPasswordFor(
+                principal,
+                ChangePasswordRequest("it is a new password")
+            )
+        } throws AccountNotFoundException("")
 
         mokMvc.perform(
             put("/api/accounts/password")
@@ -84,18 +92,24 @@ internal class ChangePasswordEndPointTest {
         )
             .andExpect(status().isInternalServerError)
 
-        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password"))  }
+        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password")) }
 
     }
+
     @Test
-    internal fun `when a change password that do ntoo meet the security requirements`() {
+    fun `when a change password that do ntoo meet the security requirements`() {
         val principal = principalFor(
             A_CLIENT_APP_ID,
             EMAIL,
             listOf(VAUTHENTICATOR_ADMIN),
             listOf(Scope.RESET_PASSWORD.content)
         )
-        every { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password")) } throws PasswordPolicyViolation("")
+        every {
+            changePassword.resetPasswordFor(
+                principal,
+                ChangePasswordRequest("it is a new password")
+            )
+        } throws PasswordPolicyViolation("")
 
         mokMvc.perform(
             put("/api/accounts/password")
@@ -105,7 +119,7 @@ internal class ChangePasswordEndPointTest {
         )
             .andExpect(status().isInternalServerError)
 
-        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password"))  }
+        verify { changePassword.resetPasswordFor(principal, ChangePasswordRequest("it is a new password")) }
 
     }
 
diff --git a/src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorEndPointTest.kt b/src/test/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPointTest.kt
similarity index 89%
rename from src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorEndPointTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPointTest.kt
index cb4ad32f..3fd75277 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorEndPointTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/api/PasswordGeneratorEndPointTest.kt
@@ -1,6 +1,7 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.api
 
 import com.fasterxml.jackson.databind.ObjectMapper
+import com.vauthenticator.server.password.domain.PasswordGenerator
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
 import io.mockk.junit5.MockKExtension
@@ -15,7 +16,7 @@ import org.springframework.test.web.servlet.result.MockMvcResultMatchers.status
 import org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup
 
 @ExtendWith(MockKExtension::class)
-internal class PasswordGeneratorEndPointTest {
+class PasswordGeneratorEndPointTest {
 
     private val objectMapper = ObjectMapper()
 
@@ -25,7 +26,7 @@ internal class PasswordGeneratorEndPointTest {
     lateinit var passwordGenerator: PasswordGenerator
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         mokMvc = standaloneSetup(
             PasswordGeneratorEndPoint(passwordGenerator)
         ).build()
diff --git a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEndPointTest.kt b/src/test/kotlin/com/vauthenticator/server/password/api/ResetPasswordEndPointTest.kt
similarity index 89%
rename from src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEndPointTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/api/ResetPasswordEndPointTest.kt
index 71ae8900..4a1d60ce 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEndPointTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/api/ResetPasswordEndPointTest.kt
@@ -1,9 +1,11 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.api
 
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientApplicationRepository
 import com.vauthenticator.server.oauth2.clientapp.domain.Scope
+import com.vauthenticator.server.password.domain.resetpassword.ResetAccountPassword
+import com.vauthenticator.server.password.domain.resetpassword.SendResetPasswordMailChallenge
 import com.vauthenticator.server.role.domain.PermissionValidator
 import com.vauthenticator.server.support.A_CLIENT_APP_ID
 import com.vauthenticator.server.support.ClientAppFixture.aClientApp
@@ -27,7 +29,7 @@ import org.springframework.test.web.servlet.setup.MockMvcBuilders
 import java.util.*
 
 @ExtendWith(MockKExtension::class)
-internal class ResetPasswordEndPointTest {
+class ResetPasswordEndPointTest {
     private val objectMapper = ObjectMapper()
 
     lateinit var mokMvc: MockMvc
@@ -45,7 +47,7 @@ internal class ResetPasswordEndPointTest {
     lateinit var resetAccountPassword: ResetAccountPassword
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         mokMvc =
             MockMvcBuilders.standaloneSetup(
                 ResetPasswordEndPoint(
@@ -58,7 +60,7 @@ internal class ResetPasswordEndPointTest {
     }
 
     @Test
-    internal fun `when a challenge is sent`() {
+    fun `when a challenge is sent`() {
         val principal = principalFor(
             A_CLIENT_APP_ID,
             EMAIL,
@@ -77,7 +79,7 @@ internal class ResetPasswordEndPointTest {
     }
 
     @Test
-    internal fun `when a password is reset as anonymous but starting from ui`() {
+    fun `when a password is reset as anonymous but starting from ui`() {
         every { sendResetPasswordMailChallenge.sendResetPasswordMailFor(EMAIL) } just runs
         every { clientApplicationRepository.findOne(clientAppId) } returns Optional.of(
             aClientApp(
@@ -96,7 +98,7 @@ internal class ResetPasswordEndPointTest {
     }
 
     @Test
-    internal fun `when a password is reset`() {
+    fun `when a password is reset`() {
         val request = ResetPasswordRequest("A_NEW_PSWD")
         val ticket = "A_TICKET"
 
diff --git a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordControllerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordControllerTest.kt
deleted file mode 100644
index c6eda23c..00000000
--- a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordControllerTest.kt
+++ /dev/null
@@ -1,4 +0,0 @@
-package com.vauthenticator.server.password.changepassword
-
-//todo
-class ChangePasswordControllerTest
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/PasswordGeneratorTest.kt
similarity index 50%
rename from src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/PasswordGeneratorTest.kt
index 58edcd0b..16c80650 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/PasswordGeneratorTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/PasswordGeneratorTest.kt
@@ -1,7 +1,6 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.domain
 
-import org.junit.jupiter.api.Assertions.assertEquals
-import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Test
 
 private const val STRONG_PASSWORD_LENGTH = 20
@@ -15,8 +14,8 @@ class PasswordGeneratorTest {
     fun name() {
 
         val actual = uut.generate()
-        assertEquals(STRONG_PASSWORD_LENGTH, actual.length)
-        assertTrue(actual.length == STRONG_PASSWORD_LENGTH)
+        Assertions.assertEquals(STRONG_PASSWORD_LENGTH, actual.length)
+        Assertions.assertTrue(actual.length == STRONG_PASSWORD_LENGTH)
     }
 
 }
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/PasswordPolicyTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/PasswordPolicyTest.kt
similarity index 59%
rename from src/test/kotlin/com/vauthenticator/server/password/PasswordPolicyTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/PasswordPolicyTest.kt
index b72df050..0457d139 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/PasswordPolicyTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/PasswordPolicyTest.kt
@@ -1,18 +1,18 @@
-package com.vauthenticator.server.password
+package com.vauthenticator.server.password.domain
 
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
 import io.mockk.junit5.MockKExtension
 import io.mockk.just
 import io.mockk.runs
-import org.junit.jupiter.api.Assertions.assertThrows
+import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.extension.ExtendWith
 
 private const val A_USERNAME = "A_USERNAME"
 
 @ExtendWith(MockKExtension::class)
-internal class PasswordPolicyTest {
+class PasswordPolicyTest {
 
     @MockK
     private lateinit var firstPolicy: PasswordPolicy
@@ -27,31 +27,31 @@ internal class PasswordPolicyTest {
     private lateinit var passwordEncoder: VAuthenticatorPasswordEncoder
 
     @Test
-    internal fun `when a password has no special character`() {
+    fun `when a password has no special character`() {
         val underTest = SpecialCharacterPasswordPolicy(2)
-        assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME,"aPassword") }
+        Assertions.assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME, "aPassword") }
     }
 
     @Test
-    internal fun `when a password has enoguht special  character`() {
+    fun `when a password has enoguht special  character`() {
         val underTest = SpecialCharacterPasswordPolicy(2)
-        underTest.accept(A_USERNAME,"aPa!%ssword")
+        underTest.accept(A_USERNAME, "aPa!%ssword")
     }
 
     @Test
-    internal fun `when a password has not allowed special character`() {
+    fun `when a password has not allowed special character`() {
         val underTest = MinimumCharacterPasswordPolicy(8)
-        assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME,"1245789") }
+        Assertions.assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME, "1245789") }
     }
 
     @Test
-    internal fun `when a set of password policies are invoked`() {
+    fun `when a set of password policies are invoked`() {
         val underTest = CompositePasswordPolicy(setOf(firstPolicy, secondPolicy))
 
-        every { firstPolicy.accept(A_USERNAME,"1245789") } just runs
-        every { secondPolicy.accept(A_USERNAME,"1245789") } throws PasswordPolicyViolation("")
+        every { firstPolicy.accept(A_USERNAME, "1245789") } just runs
+        every { secondPolicy.accept(A_USERNAME, "1245789") } throws PasswordPolicyViolation("")
 
-        assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME,"1245789") }
+        Assertions.assertThrows(PasswordPolicyViolation::class.java) { underTest.accept(A_USERNAME, "1245789") }
     }
 
     @Test
@@ -71,6 +71,6 @@ internal class PasswordPolicyTest {
         every { passwordEncoder.matches(password, password) } returns true
         every { passwordHistoryRepository.load(A_USERNAME) } returns passwordHistory
 
-        assertThrows(PasswordPolicyViolation::class.java) { uut.accept(A_USERNAME,password) }
+        Assertions.assertThrows(PasswordPolicyViolation::class.java) { uut.accept(A_USERNAME, password) }
     }
 }
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/domain/ReusePreventionPasswordPolicyTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/ReusePreventionPasswordPolicyTest.kt
new file mode 100644
index 00000000..fdc91a92
--- /dev/null
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/ReusePreventionPasswordPolicyTest.kt
@@ -0,0 +1,4 @@
+package com.vauthenticator.server.password.domain
+
+class ReusePreventionPasswordPolicyTest {
+}
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumerTest.kt
similarity index 85%
rename from src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumerTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumerTest.kt
index e40afe28..3e8c316d 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordEventConsumerTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordEventConsumerTest.kt
@@ -1,9 +1,9 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.events.ChangePasswordEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import com.vauthenticator.server.support.ClientAppFixture
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
diff --git a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt
similarity index 97%
rename from src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt
index e4cf8be9..1b908ee6 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordLoginWorkflowHandlerTest.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.account.AccountMandatoryAction.RESET_PASSWORD
 import com.vauthenticator.server.account.repository.AccountRepository
@@ -50,6 +50,7 @@ class ChangePasswordLoginWorkflowHandlerTest {
 
         assertTrue(actual)
     }
+
     @Test
     fun `when the change password is not required`() {
         val uut = ChangePasswordLoginWorkflowHandler(accountRepository, handler)
diff --git a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordTest.kt
similarity index 90%
rename from src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordTest.kt
index fc4269f8..7ee7c268 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/changepassword/ChangePasswordTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/changepassword/ChangePasswordTest.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.changepassword
+package com.vauthenticator.server.password.domain.changepassword
 
 import com.vauthenticator.server.account.AccountNotFoundException
 import com.vauthenticator.server.account.repository.AccountRepository
@@ -6,8 +6,8 @@ import com.vauthenticator.server.events.ChangePasswordEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
 import com.vauthenticator.server.oauth2.clientapp.domain.ClientAppId
 import com.vauthenticator.server.oauth2.clientapp.domain.Scope
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.support.A_CLIENT_APP_ID
 import com.vauthenticator.server.support.AccountTestFixture.anAccount
 import com.vauthenticator.server.support.EMAIL
@@ -27,7 +27,7 @@ import org.springframework.test.web.servlet.MockMvc
 import java.util.*
 
 @ExtendWith(MockKExtension::class)
-internal class ChangePasswordTest {
+class ChangePasswordTest {
 
     lateinit var mokMvc: MockMvc
 
@@ -48,7 +48,7 @@ internal class ChangePasswordTest {
     lateinit var eventsDispatcher: VAuthenticatorEventsDispatcher
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         underTest = ChangePassword(
             eventsDispatcher,
             passwordPolicy,
@@ -58,7 +58,7 @@ internal class ChangePasswordTest {
     }
 
     @Test
-    internal fun `when a change password attempt is executed`() {
+    fun `when a change password attempt is executed`() {
         val account = anAccount()
         val principal = principalFor(
             A_CLIENT_APP_ID,
@@ -83,7 +83,7 @@ internal class ChangePasswordTest {
     }
 
     @Test
-    internal fun `when a user is not found`() {
+    fun `when a user is not found`() {
         val principal = principalFor(
             A_CLIENT_APP_ID,
             EMAIL,
diff --git a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPasswordTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPasswordTest.kt
similarity index 76%
rename from src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPasswordTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPasswordTest.kt
index 43d041e7..4d58a7d7 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetAccountPasswordTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetAccountPasswordTest.kt
@@ -1,10 +1,11 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.events.ResetPasswordEvent
 import com.vauthenticator.server.events.VAuthenticatorEventsDispatcher
-import com.vauthenticator.server.password.PasswordPolicy
-import com.vauthenticator.server.password.VAuthenticatorPasswordEncoder
+import com.vauthenticator.server.password.api.ResetPasswordRequest
+import com.vauthenticator.server.password.domain.PasswordPolicy
+import com.vauthenticator.server.password.domain.VAuthenticatorPasswordEncoder
 import com.vauthenticator.server.support.AccountTestFixture.anAccount
 import com.vauthenticator.server.support.TicketFixture
 import com.vauthenticator.server.ticket.domain.InvalidTicketException
@@ -22,7 +23,7 @@ import org.junit.jupiter.api.extension.ExtendWith
 import java.util.*
 
 @ExtendWith(MockKExtension::class)
-internal class ResetAccountPasswordTest {
+class ResetAccountPasswordTest {
 
     lateinit var underTest: ResetAccountPassword
 
@@ -39,23 +40,29 @@ internal class ResetAccountPasswordTest {
     lateinit var vAuthenticatorPasswordEncoder: VAuthenticatorPasswordEncoder
 
     @MockK
-    lateinit var eventsDispatcher : VAuthenticatorEventsDispatcher
+    lateinit var eventsDispatcher: VAuthenticatorEventsDispatcher
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         underTest =
-            ResetAccountPassword(eventsDispatcher,accountRepository, vAuthenticatorPasswordEncoder, passwordPolicy, ticketRepository)
+            ResetAccountPassword(
+                eventsDispatcher,
+                accountRepository,
+                vAuthenticatorPasswordEncoder,
+                passwordPolicy,
+                ticketRepository
+            )
     }
 
     @Test
-    internal fun `happy path`() {
+    fun `happy path`() {
         val anAccount = anAccount()
         val email = anAccount.email
 
         val ticketId = TicketId("A_TICKET")
         val ticket = TicketFixture.ticketFor(ticketId.content, email, "")
 
-        every { passwordPolicy.accept(email,"NEW_PSWD") } just runs
+        every { passwordPolicy.accept(email, "NEW_PSWD") } just runs
         every { ticketRepository.loadFor(ticketId) } returns Optional.of(ticket)
         every { ticketRepository.delete(ticketId) } just runs
         every { accountRepository.accountFor(email) } returns Optional.of(anAccount)
@@ -67,7 +74,7 @@ internal class ResetAccountPasswordTest {
     }
 
     @Test
-    internal fun `when a ticket was revoked`() {
+    fun `when a ticket was revoked`() {
         val ticketId = TicketId("A_TICKET")
 
         every { passwordPolicy.accept("A_USERNAME", "NEW_PSWD") } just runs
diff --git a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumerTest.kt
similarity index 85%
rename from src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumerTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumerTest.kt
index 5235cdbc..d16fd924 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordEventConsumerTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/ResetPasswordEventConsumerTest.kt
@@ -1,9 +1,9 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.account.Email
 import com.vauthenticator.server.events.ResetPasswordEvent
-import com.vauthenticator.server.password.Password
-import com.vauthenticator.server.password.PasswordHistoryRepository
+import com.vauthenticator.server.password.domain.Password
+import com.vauthenticator.server.password.domain.PasswordHistoryRepository
 import com.vauthenticator.server.support.ClientAppFixture
 import io.mockk.every
 import io.mockk.impl.annotations.MockK
diff --git a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallengeTest.kt b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallengeTest.kt
similarity index 89%
rename from src/test/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallengeTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallengeTest.kt
index 5dbc284f..c95efc45 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/SendResetPasswordMailChallengeTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/domain/resetpassword/SendResetPasswordMailChallengeTest.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.domain.resetpassword
 
 import com.vauthenticator.server.account.repository.AccountRepository
 import com.vauthenticator.server.communication.domain.EMailSenderService
@@ -17,7 +17,7 @@ import org.junit.jupiter.api.extension.ExtendWith
 import java.util.*
 
 @ExtendWith(MockKExtension::class)
-internal class SendResetPasswordMailChallengeTest {
+class SendResetPasswordMailChallengeTest {
 
     lateinit var underTest: SendResetPasswordMailChallenge
 
@@ -31,7 +31,7 @@ internal class SendResetPasswordMailChallengeTest {
     lateinit var emailSenderService: EMailSenderService
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         underTest = SendResetPasswordMailChallenge(
             accountRepository,
             ticketCreator,
@@ -41,7 +41,7 @@ internal class SendResetPasswordMailChallengeTest {
     }
 
     @Test
-    internal fun `when the reset password challenge is sent`() {
+    fun `when the reset password challenge is sent`() {
         val anAccount = anAccount()
 
         every { accountRepository.accountFor(anAccount.email) } returns Optional.of(anAccount)
diff --git a/src/test/kotlin/com/vauthenticator/server/password/web/ChangePasswordControllerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/web/ChangePasswordControllerTest.kt
new file mode 100644
index 00000000..d8fdc3e1
--- /dev/null
+++ b/src/test/kotlin/com/vauthenticator/server/password/web/ChangePasswordControllerTest.kt
@@ -0,0 +1,4 @@
+package com.vauthenticator.server.password.web
+
+//todo
+class ChangePasswordControllerTest
\ No newline at end of file
diff --git a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordControllerTest.kt b/src/test/kotlin/com/vauthenticator/server/password/web/ResetPasswordControllerTest.kt
similarity index 88%
rename from src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordControllerTest.kt
rename to src/test/kotlin/com/vauthenticator/server/password/web/ResetPasswordControllerTest.kt
index a63830d8..baf268a1 100644
--- a/src/test/kotlin/com/vauthenticator/server/password/resetpassword/ResetPasswordControllerTest.kt
+++ b/src/test/kotlin/com/vauthenticator/server/password/web/ResetPasswordControllerTest.kt
@@ -1,4 +1,4 @@
-package com.vauthenticator.server.password.resetpassword
+package com.vauthenticator.server.password.web
 
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.vauthenticator.server.i18n.I18nMessageInjector
@@ -18,7 +18,7 @@ import org.springframework.test.web.servlet.result.MockMvcResultMatchers.*
 import org.springframework.test.web.servlet.setup.MockMvcBuilders
 
 @ExtendWith(MockKExtension::class)
-internal class ResetPasswordControllerTest {
+class ResetPasswordControllerTest {
     lateinit var mokMvc: MockMvc
 
     val objectMapper = ObjectMapper()
@@ -27,13 +27,13 @@ internal class ResetPasswordControllerTest {
     lateinit var i18nMessageInjector: I18nMessageInjector
 
     @BeforeEach
-    internal fun setUp() {
+    fun setUp() {
         mokMvc = MockMvcBuilders.standaloneSetup(ResetPasswordController(i18nMessageInjector, ObjectMapper()))
             .build()
     }
 
     @Test
-    internal fun `when the reset password challenge page is shown`() {
+    fun `when the reset password challenge page is shown`() {
         every { i18nMessageInjector.setMessagedFor(I18nScope.RESET_PASSWORD_CHALLENGE_SENDER_PAGE, any()) } just runs
 
         mokMvc.perform(get("/reset-password/reset-password-challenge-sender"))
@@ -45,7 +45,7 @@ internal class ResetPasswordControllerTest {
     }
 
     @Test
-    internal fun `when the successful reset password challenge page is shown`() {
+    fun `when the successful reset password challenge page is shown`() {
         every {
             i18nMessageInjector.setMessagedFor(
                 I18nScope.SUCCESSFUL_RESET_PASSWORD_CHALLENGE_SENDER_PAGE,
@@ -63,7 +63,7 @@ internal class ResetPasswordControllerTest {
     }
 
     @Test
-    internal fun `when the reset password page is shown`() {
+    fun `when the reset password page is shown`() {
         every { i18nMessageInjector.setMessagedFor(I18nScope.RESET_PASSWORD_PAGE, any()) } just runs
 
         mokMvc.perform(get("/reset-password/{ticket}", "A_TICKET"))
@@ -76,7 +76,7 @@ internal class ResetPasswordControllerTest {
     }
 
     @Test
-    internal fun `when the successful reset password page is shown`() {
+    fun `when the successful reset password page is shown`() {
         every {
             i18nMessageInjector.setMessagedFor(
                 I18nScope.SUCCESSFUL_RESET_PASSWORD_PAGE,