diff --git a/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java
index 3806b6b24..16d140cb1 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java
@@ -321,6 +321,14 @@ public class UserPendingWritePlatformServiceImpl implements UserPendingWritePlat
                 .orElseThrow(() -> new UserNotFoundException(request.getUserId()));
 
         final JsonElement parsedElement = this.fromApiJsonHelper.parse(request.getPayloadJson());
+        if (parsedElement.isJsonObject()) {
+            // the stored payload keeps a "[PROTECTED]" placeholder for the password rather than
+            // the real value; the actual new password is applied below via request.getPasswordHash(),
+            // so these keys must not reach AppUser.update() or it will try to re-encode the placeholder
+            final JsonObject payloadObject = parsedElement.getAsJsonObject();
+            payloadObject.remove("password");
+            payloadObject.remove("repeatPassword");
+        }
         final JsonCommand replay = JsonCommand.fromJsonElement(request.getUserId(), parsedElement, this.fromApiJsonHelper);
 
         final Map<String, Object> changes = userToUpdate.update(replay, null, null);