diff --git a/Claude.md b/Claude.md
index 2104137..bd6be52 100644
--- a/Claude.md
+++ b/Claude.md
@@ -70,7 +70,13 @@ audiences:
 │   └── versions/            # Alembic migration scripts
 ├── gunicorn.conf.py
 ├── run.py                   # Entry point — calls eventlet.monkey_patch() first
-└── .env                     # Secrets (not committed)
+├── .env                     # Secrets (not committed)
+└── license_server/          # Vendor-only — NOT shipped to customers
+    ├── app.py               # Internal Flask UI for generating license keys
+    ├── generate_keys.py     # One-time RSA key pair generator
+    ├── requirements.txt     # flask + cryptography
+    ├── private_key.pem      # RSA private key — NEVER commit or ship
+    └── licenses.db          # SQLite log of issued keys
 ```
 
 ---
diff --git a/app/templates/admin/edit_user.html b/app/templates/admin/edit_user.html
index 63453b0..7529d83 100644
--- a/app/templates/admin/edit_user.html
+++ b/app/templates/admin/edit_user.html
@@ -44,7 +44,11 @@
             <div class="col-12"><hr style="border-color:var(--border);"/></div>
             <div class="col-md-6">
               <label class="form-label">New Password <span style="color:var(--muted);font-weight:400;">(optional)</span></label>
-              <input type="password" class="form-control" name="new_password" placeholder="Leave blank to keep current"/>
+              <input type="password" class="form-control" id="new-password" name="new_password" placeholder="Leave blank to keep current"/>
+            </div>
+            <div class="col-md-6">
+              <label class="form-label">Confirm Password</label>
+              <input type="password" class="form-control" id="confirm-password" name="confirm_password" placeholder="Repeat new password"/>
             </div>
           </div>
           <div class="d-flex gap-2 mt-4">
@@ -57,3 +61,28 @@
   </div>
 </div>
 {% endblock %}
+
+{% block scripts %}
+<script>
+document.querySelector('form').addEventListener('submit', function (e) {
+  const pw  = document.getElementById('new-password').value;
+  const pw2 = document.getElementById('confirm-password').value;
+  if (pw !== pw2) {
+    e.preventDefault();
+    document.getElementById('confirm-password').style.borderColor = 'var(--danger)';
+    const msg = document.createElement('div');
+    msg.style.cssText = 'font-size:12px;color:var(--danger);margin-top:4px;';
+    msg.textContent = 'Passwords do not match.';
+    const existing = document.getElementById('pw-match-msg');
+    if (existing) existing.remove();
+    msg.id = 'pw-match-msg';
+    document.getElementById('confirm-password').insertAdjacentElement('afterend', msg);
+  }
+});
+document.getElementById('confirm-password').addEventListener('input', function () {
+  this.style.borderColor = '';
+  const msg = document.getElementById('pw-match-msg');
+  if (msg) msg.remove();
+});
+</script>
+{% endblock %}