diff --git a/projects/samskivert/src/java/com/samskivert/servlet/user/UserManager.java b/projects/samskivert/src/java/com/samskivert/servlet/user/UserManager.java
index 42621e78..8310e42a 100644
--- a/projects/samskivert/src/java/com/samskivert/servlet/user/UserManager.java
+++ b/projects/samskivert/src/java/com/samskivert/servlet/user/UserManager.java
@@ -245,7 +245,7 @@ public class UserManager
 	}
 
         // potentially convert the user's legacy password
-        if (password.getCleartext() != null &&
+        if (password != null && password.getCleartext() != null &&
             user.updateLegacyPassword(password.getCleartext())) {
             Log.info("Updated legacy password " + user.username + ".");
             _repository.updateUser(user);