# `setPasswordCompromised()`

Sets the given user's password as compromised. The user will be prompted to reset their password on their next sign-in. See the [guide on password protection and rules](/content/docs/guides/secure/password-protection-and-rules#reject-compromised-passwords/index.html) for more information.

Returns the updated [`User`](/content/docs/reference/backend/types/backend-user/index.html).

```
function setPasswordCompromised(userId: string, params: { revokeAllSessions?: boolean }): Promise<User>
```

## Parameters

- **Name:** `userId`  
  **Type:** `string`  
  **Description:** The ID of the user to set the password as compromised for.

- **Name:** `params`  
  **Type:** `{ revokeAllSessions?: boolean; }`  
  **Description:** Other parameters for the request.

- **Name:** `params.revokeAllSessions?`  
  **Type:** `boolean`  
  **Description:** Whether to revoke all sessions of the user. Defaults to `false`.

## Usage

Note

Using `clerkClient` varies based on the SDK you're using. Refer to the [overview](/content/docs/reference/backend/overview/index.html) for usage details, including guidance on [how to access the `userId` and other properties](/content/docs/reference/backend/overview#example-get-the-user-id-and-other-properties/index.html).

```
const userId = 'user_123'

const response = await clerkClient.users.setPasswordCompromised(userId, {
  revokeAllSessions: true,
})
```

## Backend API (BAPI) endpoint

This method in the SDK is a wrapper around the BAPI endpoint `POST/users/{user_id}/password/set_compromised`. See the [BAPI reference⁠](/content/docs/reference/backend-api/tag/users/POST/users/%7Buser_id%7D/password/set_compromised/index.html) for more information.