diff --git a/synapse/rest/client/v2_alpha/capabilities.py b/synapse/rest/client/v2_alpha/capabilities.py
index 767e6c9798..08df941b5f 100644
--- a/synapse/rest/client/v2_alpha/capabilities.py
+++ b/synapse/rest/client/v2_alpha/capabilities.py
@@ -12,14 +12,20 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+import logging
+
 from twisted.internet import defer
 
 from synapse.http.servlet import RestServlet
 
 from ._base import client_v2_patterns
 
+logger = logging.getLogger(__name__)
+
 
 class CapabilitiesRestServlet(RestServlet):
+    """End point to expose the capabilities of the server."""
+
     PATTERNS = client_v2_patterns("/capabilities$")
 
     def __init__(self, hs):
@@ -30,11 +36,14 @@ class CapabilitiesRestServlet(RestServlet):
         super(CapabilitiesRestServlet, self).__init__()
         self.hs = hs
         self.auth = hs.get_auth()
+        self.store = hs.get_datastore()
 
     @defer.inlineCallbacks
     def on_GET(self, request):
+        requester = yield self.auth.get_user_by_req(request, allow_guest=True)
+        user = yield self.store.get_user_by_id(requester.user.to_string())
+        change_password = bool(user['password_hash'])
 
-        yield self.auth.get_user_by_req(request, allow_guest=True)
         defer.returnValue(
             (200, {
                 "capabilities": {
@@ -45,7 +54,8 @@ class CapabilitiesRestServlet(RestServlet):
                             "2": "stable",
                             "state-v2-test": "unstable",
                         }
-                    }
+                    },
+                    "m.change_password": change_password,
                 }
             })
         )
diff --git a/tests/rest/client/v2_alpha/test_capabilities.py b/tests/rest/client/v2_alpha/test_capabilities.py
index 131a4af417..62dbfa06b2 100644
--- a/tests/rest/client/v2_alpha/test_capabilities.py
+++ b/tests/rest/client/v2_alpha/test_capabilities.py
@@ -31,6 +31,7 @@ class CapabilitiesTestCase(unittest.HomeserverTestCase):
     def make_homeserver(self, reactor, clock):
         self.url = b"/_matrix/client/r0/capabilities"
         hs = self.setup_test_homeserver()
+        self.store = hs.get_datastore()
         return hs
 
     def test_check_auth_required(self):
@@ -53,3 +54,25 @@ class CapabilitiesTestCase(unittest.HomeserverTestCase):
         self.assertEqual(
             DEFAULT_ROOM_VERSION, capabilities['m.room_versions']['default']
         )
+
+    def test_get_change_password_capabilities(self):
+        localpart = "user"
+        password = "pass"
+        user = self.register_user(localpart, password)
+        access_token = self.login(user, password)
+
+        request, channel = self.make_request("GET", self.url, access_token=access_token)
+        self.render(request)
+        capabilities = channel.json_body['capabilities']
+
+        self.assertEqual(channel.code, 200)
+
+        # Test case where password is handled outside of Synapse
+        self.assertTrue(capabilities['m.change_password'])
+        self.get_success(self.store.user_set_password_hash(user, None))
+        request, channel = self.make_request("GET", self.url, access_token=access_token)
+        self.render(request)
+        capabilities = channel.json_body['capabilities']
+
+        self.assertEqual(channel.code, 200)
+        self.assertFalse(capabilities['m.change_password'])