diff --git a/src/main/java/com/example/mindflux/controller/AdminUserController.java b/src/main/java/com/example/mindflux/controller/AdminUserController.java
index c3c0229..65aede1 100644
--- a/src/main/java/com/example/mindflux/controller/AdminUserController.java
+++ b/src/main/java/com/example/mindflux/controller/AdminUserController.java
@@ -39,10 +39,17 @@ public class AdminUserController {
 
     @PostMapping("/users/save")
     public String saveUser(@ModelAttribute("user") User user) {
-        if (user.getId() != null && (user.getPassword() == null || user.getPassword().isBlank())) {
+        if (user.getId() != null) {
             User existingUser = userService.findById(user.getId())
                     .orElseThrow(() -> new IllegalArgumentException("Ungültige User-ID: " + user.getId()));
-            user.setPassword(existingUser.getPassword());
+            // Passwort: leer = unverändert übernehmen, sonst neu verschlüsseln (Admin-Reset)
+            if (user.getPassword() == null || user.getPassword().isBlank()) {
+                user.setPassword(existingUser.getPassword());
+            } else {
+                user.setPassword(passwordEncoder.encode(user.getPassword()));
+            }
+            // Profilbild steht nicht im Formular -> bestehendes erhalten, nicht überschreiben
+            user.setProfilePicture(existingUser.getProfilePicture());
         } else {
             user.setPassword(passwordEncoder.encode(user.getPassword()));
         }
@@ -51,6 +58,18 @@ public class AdminUserController {
         return "redirect:/admin/users";
     }
 
+    /** Direktes Zurücksetzen des Passworts eines Nutzers (Admin-Recovery, ohne E-Mail). */
+    @PostMapping("/users/{id}/reset-password")
+    public String resetPassword(@PathVariable Long id, @RequestParam String newPassword) {
+        if (newPassword != null && !newPassword.isBlank()) {
+            User user = userService.findById(id)
+                    .orElseThrow(() -> new IllegalArgumentException("Ungültige User-ID: " + id));
+            user.setPassword(passwordEncoder.encode(newPassword.trim()));
+            userService.save(user);
+        }
+        return "redirect:/admin/users";
+    }
+
     @GetMapping("/users/edit/{id}")
     public String editUserForm(@PathVariable Long id, Model model) {
         User user = userService.findById(id).orElseThrow(() -> new IllegalArgumentException("Ungültige User-ID: " + id));
diff --git a/src/main/resources/templates/admin/users/form.html b/src/main/resources/templates/admin/users/form.html
index f8abf80..09c8f5d 100644
--- a/src/main/resources/templates/admin/users/form.html
+++ b/src/main/resources/templates/admin/users/form.html
@@ -34,8 +34,9 @@
             </div>
 
             <div class="mf-field">
-                <label class="mf-label">Passwort</label>
-                <input class="mf-input" type="password" name="password" th:required="${user.id == null}" autocomplete="new-password"/>
+                <label class="mf-label" th:text="${user.id == null} ? 'Passwort' : 'Neues Passwort (leer lassen = unverändert)'">Passwort</label>
+                <input class="mf-input" type="password" name="password" th:required="${user.id == null}" autocomplete="new-password"
+                       th:placeholder="${user.id == null} ? 'Passwort' : 'leer lassen = unverändert'"/>
             </div>
 
             <div class="mf-field">
diff --git a/src/main/resources/templates/admin/users/list.html b/src/main/resources/templates/admin/users/list.html
index f3dc2ca..121ecfd 100644
--- a/src/main/resources/templates/admin/users/list.html
+++ b/src/main/resources/templates/admin/users/list.html
@@ -43,9 +43,17 @@
                         <td th:text="${user.id}">1</td>
                         <td th:text="${user.username}">Max</td>
                         <td th:text="${user.email}">max@mindflux.de</td>
-                        <td style="display:flex; gap:.5rem; flex-wrap:wrap;">
+                        <td style="display:flex; gap:.5rem; flex-wrap:wrap; align-items:center;">
                             <a th:href="@{'/admin/users/edit/' + ${user.id}}" class="mf-btn outline">Bearbeiten</a>
-                            <form th:action="@{'/admin/users/delete/' + ${user.id}}" method="post" style="display:inline;">
+                            <form th:action="@{'/admin/users/' + ${user.id} + '/reset-password'}" method="post"
+                                  style="display:flex; gap:.35rem; align-items:center;"
+                                  onsubmit="return confirm('Passwort für diesen Nutzer wirklich neu setzen?');">
+                                <input class="mf-input" type="text" name="newPassword" placeholder="Neues Passwort"
+                                       required minlength="4" style="width:150px; padding:.45rem .6rem;">
+                                <button type="submit" class="mf-btn">PW zurücksetzen</button>
+                            </form>
+                            <form th:action="@{'/admin/users/delete/' + ${user.id}}" method="post" style="display:inline;"
+                                  onsubmit="return confirm('Benutzer wirklich löschen?');">
                                 <button type="submit" class="mf-btn danger">Löschen</button>
                             </form>
                         </td>