diff --git a/app/models/user.rb b/app/models/user.rb
index 557453d..086450b 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,17 +1,19 @@
 # == Schema Information
-# Schema version: 20100821203213
+# Schema version: 20100822204528
 #
 # Table name: users
 #
-#  id         :integer         not null, primary key
-#  name       :string(255)
-#  email      :string(255)
-#  created_at :datetime
-#  updated_at :datetime
+#  id                 :integer         not null, primary key
+#  name               :string(255)
+#  email              :string(255)
+#  created_at         :datetime
+#  updated_at         :datetime
+#  encrypted_password :string(255)
 #
 
 class User < ActiveRecord::Base
-  attr_accessible :name, :email
+  attr_accessor   :password
+  attr_accessible :name, :email, :password, :password_confirmation
   
   email_regex = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
   
@@ -20,4 +22,7 @@ class User < ActiveRecord::Base
   validates :email, :presence   => true,
                     :format     => { :with => email_regex },
                     :uniqueness => { :case_sensitive => false }
+  validates :password, :presence => true,
+                       :confirmation => true,
+                       :length => { :within => 6..40 }
 end
diff --git a/db/migrate/20100822204528_add_password_to_users.rb b/db/migrate/20100822204528_add_password_to_users.rb
new file mode 100644
index 0000000..0621dc1
--- /dev/null
+++ b/db/migrate/20100822204528_add_password_to_users.rb
@@ -0,0 +1,9 @@
+class AddPasswordToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :encrypted_password, :string
+  end
+
+  def self.down
+    remove_column :users, :encrypted_password
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 400d256..aec9a72 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,13 +10,14 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20100822012431) do
+ActiveRecord::Schema.define(:version => 20100822204528) do
 
   create_table "users", :force => true do |t|
     t.string   "name"
     t.string   "email"
     t.datetime "created_at"
     t.datetime "updated_at"
+    t.string   "encrypted_password"
   end
 
   add_index "users", ["email"], :name => "index_users_on_email", :unique => true
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index b08980c..b3792d4 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -3,7 +3,12 @@
 describe User do
   
   before(:each) do
-    @attr = { :name => "Example User", :email => "user@example.com" }
+    @attr = { 
+      :name => "Example User",
+      :email => "user@example.com",
+      :password => "foobar",
+      :password_confirmation => "foobar"
+    }
   end
   
   it "should create a new instance given a valid attribute" do
@@ -54,4 +59,55 @@
     user_with_duplicate_email = User.new(@attr)
     user_with_duplicate_email.should_not be_valid
   end
+  
+  describe "passwords" do
+
+    before(:each) do
+      @user = User.new(@attr)
+    end
+
+    it "should have a password attribute" do
+      @user.should respond_to(:password)
+    end
+
+    it "should have a password confirmation attribute" do
+      @user.should respond_to(:password_confirmation)
+    end
+  end
+  
+  describe "password validations" do
+
+    it "should require a password" do
+      User.new(@attr.merge(:password => "", :password_confirmation => "")).
+        should_not be_valid
+    end
+
+    it "should require a matching password confirmation" do
+      User.new(@attr.merge(:password_confirmation => "invalid")).
+        should_not be_valid
+    end
+    
+    it "should reject short passwords" do
+      short = "a" * 5
+      hash = @attr.merge(:password => short, :password_confirmation => short)
+      User.new(hash).should_not be_valid
+    end
+    
+    it "should reject long passwords" do
+      long = "a" * 41
+      hash = @attr.merge(:password => long, :password_confirmation => long)
+      User.new(hash).should_not be_valid
+    end
+  end
+  
+  describe "password encryption" do
+    
+    before(:each) do
+      @user = User.create!(@attr)
+    end
+    
+    it "should have an encrypted password attribute" do
+      @user.should respond_to(:encrypted_password)
+    end
+  end
 end