diff --git a/frontend/src/routes/user/EditableField.svelte b/frontend/src/routes/user/EditableField.svelte
index d818ccf..fad3ccc 100644
--- a/frontend/src/routes/user/EditableField.svelte
+++ b/frontend/src/routes/user/EditableField.svelte
@@ -13,7 +13,9 @@
     function check_key(evt){
         if (evt.key === 'Enter'){
             input = false;
-            onUpdate({key:key,value:value});
+            let obj = {};
+            obj[key] = value;
+            onUpdate(obj);
         }
     }
 </script>
diff --git a/frontend/src/routes/user/User.svelte b/frontend/src/routes/user/User.svelte
index 7788933..90c3318 100644
--- a/frontend/src/routes/user/User.svelte
+++ b/frontend/src/routes/user/User.svelte
@@ -26,12 +26,12 @@
             <td>{user.id}</td>
         </tr>
         <EditableField key='user.name' value={user.name} onUpdate={patch} />
-        <EditableField key='user.login' value={user.login} />
-        <EditableField key='user.email' value={user.email} />
         <tr>
-            <th>{t('user.language')}</th>
-            <td>{user.language}</td>
+            <th>{t('user.login')}</th>
+            <td>{user.login}</td>
         </tr>
+        <EditableField key='user.email' value={user.email} onUpdate={patch} />
+        <EditableField key='user.language' value={user.language} onUpdate={patch} />
         <tr>
             <th>{t('user.theme')}</th>
             <td>{user.theme}</td>
diff --git a/user/src/main/java/de/srsoftware/umbrella/user/UserModule.java b/user/src/main/java/de/srsoftware/umbrella/user/UserModule.java
index 8cd910d..ba2da29 100644
--- a/user/src/main/java/de/srsoftware/umbrella/user/UserModule.java
+++ b/user/src/main/java/de/srsoftware/umbrella/user/UserModule.java
@@ -1,13 +1,14 @@
 /* © SRSoftware 2025 */
 package de.srsoftware.umbrella.user;
 
-import static de.srsoftware.tools.Optionals.nullable;
-import static de.srsoftware.umbrella.core.Constants.PASSWORD;
+import static de.srsoftware.tools.Optionals.*;
+import static de.srsoftware.umbrella.core.Constants.*;
 import static de.srsoftware.umbrella.core.Paths.LOGOUT;
 import static de.srsoftware.umbrella.core.ResponseCode.*;
 import static de.srsoftware.umbrella.user.Constants.*;
 import static de.srsoftware.umbrella.user.Paths.LOGIN;
 import static de.srsoftware.umbrella.user.Paths.WHOAMI;
+import static java.lang.System.Logger.Level.WARNING;
 import static java.time.temporal.ChronoUnit.DAYS;
 
 import com.sun.net.httpserver.HttpExchange;
@@ -16,14 +17,13 @@ import de.srsoftware.tools.PathHandler;
 import de.srsoftware.tools.SessionToken;
 import de.srsoftware.umbrella.core.UmbrellaException;
 import de.srsoftware.umbrella.user.api.UserDb;
-import de.srsoftware.umbrella.user.model.Password;
-import de.srsoftware.umbrella.user.model.Session;
-import de.srsoftware.umbrella.user.model.Token;
-import de.srsoftware.umbrella.user.model.UmbrellaUser;
+import de.srsoftware.umbrella.user.model.*;
 import java.io.IOException;
 import java.security.NoSuchAlgorithmException;
 import java.time.Instant;
 import java.util.List;
+import java.util.Set;
+import org.json.JSONObject;
 
 
 public class UserModule extends PathHandler {
@@ -75,18 +75,24 @@ public class UserModule extends PathHandler {
 
 	public boolean doPatch(Path path, HttpExchange ex) throws IOException {
 		addCors(ex);
+		JSONObject json;
+		try {
+			json = json(ex);
+		} catch (Exception e){
+			LOG.log(WARNING,"Request does not contain valid JSON",e);
+			return sendContent(ex,BAD_REQUEST,"Body contains no JSON data");
+		}
 		var head = path.pop();
 		try {
 			if (head == null || head.isBlank()) return sendContent(ex,UNPROCESSABLE,"User id missing!");
 			long userId = Long.parseLong(head);
-			var user = users.load(userId);
-			// TODO: update user, then return user data
+			var user    = (DbUser) users.load(userId);
+			return update(ex, user,json);
 		} catch (NumberFormatException e) {
 			return sendContent(ex,UNPROCESSABLE,"Invalid user id: "+head);
 		} catch (UmbrellaException e) {
 			return sendContent(ex,e.statusCode(),e.getMessage());
 		}
-		return super.doPatch(path,ex);
 	}
 
 	@Override
@@ -144,4 +150,15 @@ public class UserModule extends PathHandler {
 			return sendContent(ex,ue.statusCode(),ue.getMessage());
 		}
 	}
+
+	private boolean update(HttpExchange ex, DbUser user, JSONObject json) throws UmbrellaException, IOException {
+		var id    = user.id();
+		var name  = json.has("user.name")     && json.get("user.name")     instanceof String s && !s.isBlank() ? s : user.name();
+		var email = json.has("user.email")    && json.get("user.email")    instanceof String e && !e.isBlank() ? e : user.email();
+		var pass  = json.has("user.password") && json.get("user.password") instanceof String p && !p.isBlank() ? Password.of(BAD_HASHER.hash(p,null)) : user.hashedPassword();
+		var theme = json.has("user.theme")    && json.get("user.theme")    instanceof String t && !t.isBlank() ? t : user.theme();
+		var lang  = json.has("user.language") && json.get("user.language") instanceof String l && !l.isBlank() ? l : user.language();
+		var saved = users.save(new DbUser(id,name,email,pass,theme,lang, Set.of(),null));
+		return sendContent(ex,OK,saved);
+	}
 }
diff --git a/user/src/main/java/de/srsoftware/umbrella/user/sqlite/SqliteDB.java b/user/src/main/java/de/srsoftware/umbrella/user/sqlite/SqliteDB.java
index 72496f2..5181e76 100644
--- a/user/src/main/java/de/srsoftware/umbrella/user/sqlite/SqliteDB.java
+++ b/user/src/main/java/de/srsoftware/umbrella/user/sqlite/SqliteDB.java
@@ -140,7 +140,7 @@ CREATE TABLE IF NOT EXISTS {0} (
 	PRIMARY KEY({1})
 )""";
 		try {
-			var stmt = db.prepareStatement(format(createTable,TABLE_USERS, ID, LOGIN, PASSWORD, THEME, EMAIL, MESSAGE_DELIVERY, LAST_LOGOFF, SETTINGS));
+			var stmt = db.prepareStatement(format(createTable,TABLE_USERS, ID, LOGIN, PASS, THEME, EMAIL, MESSAGE_DELIVERY, LAST_LOGOFF, SETTINGS));
 			stmt.execute();
 			stmt.close();
 		} catch (SQLException e) {
@@ -435,7 +435,7 @@ CREATE TABLE IF NOT EXISTS {0} (
 		try {
 			Long id = user.id();
 			if (id<1) id = null;
-			replaceInto(TABLE_USERS, ID, LOGIN, PASSWORD, THEME, EMAIL, LAST_LOGOFF)
+			replaceInto(TABLE_USERS, ID, LOGIN, PASS, THEME, EMAIL, LAST_LOGOFF)
 					.values(id,user.name(),user.hashedPassword(),user.theme(),user.email(),user.lastLogoff())
 					.execute(db)
 					.close();