diff --git a/src/main/java/in/koreatech/koin/domain/coop/controller/CoopController.java b/src/main/java/in/koreatech/koin/domain/coop/controller/CoopController.java
index 48ce881cde..4856e68eed 100644
--- a/src/main/java/in/koreatech/koin/domain/coop/controller/CoopController.java
+++ b/src/main/java/in/koreatech/koin/domain/coop/controller/CoopController.java
@@ -5,11 +5,10 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.PatchMapping;
 import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 import in.koreatech.koin.domain.coop.dto.DiningImageRequest;
-import org.springframework.web.bind.annotation.RequestMapping;
-
 import in.koreatech.koin.domain.coop.dto.SoldOutRequest;
 import in.koreatech.koin.domain.coop.service.CoopService;
 import in.koreatech.koin.global.auth.Auth;
diff --git a/src/main/java/in/koreatech/koin/domain/user/controller/UserApi.java b/src/main/java/in/koreatech/koin/domain/user/controller/UserApi.java
index 068aebdaf2..dd147bdb7a 100644
--- a/src/main/java/in/koreatech/koin/domain/user/controller/UserApi.java
+++ b/src/main/java/in/koreatech/koin/domain/user/controller/UserApi.java
@@ -14,6 +14,7 @@
 
 import in.koreatech.koin.domain.user.dto.AuthResponse;
 import in.koreatech.koin.domain.user.dto.EmailCheckExistsRequest;
+import in.koreatech.koin.domain.user.dto.FindPasswordRequest;
 import in.koreatech.koin.domain.user.dto.NicknameCheckExistsRequest;
 import in.koreatech.koin.domain.user.dto.StudentRegisterRequest;
 import in.koreatech.koin.domain.user.dto.StudentResponse;
@@ -187,4 +188,20 @@ ResponseEntity<Void> checkDuplicationOfNickname(
     ResponseEntity<AuthResponse> getAuth(
         @Auth(permit = {STUDENT, OWNER, COOP}) Long userId
     );
+
+    @ApiResponses(
+        value = {
+            @ApiResponse(responseCode = "201"),
+            @ApiResponse(responseCode = "400", content = @Content(schema = @Schema(hidden = true))),
+            @ApiResponse(responseCode = "401", content = @Content(schema = @Schema(hidden = true))),
+            @ApiResponse(responseCode = "403", content = @Content(schema = @Schema(hidden = true))),
+            @ApiResponse(responseCode = "404", content = @Content(schema = @Schema(hidden = true)))
+        }
+    )
+    @Operation(summary = "비밀번호 초기(변경) 메일 발송")
+    @PostMapping("/user/find/password")
+    ResponseEntity<Void> findPassword(
+        @RequestBody @Valid FindPasswordRequest findPasswordRequest,
+        @ServerURL String serverURL
+    );
 }
diff --git a/src/main/java/in/koreatech/koin/domain/user/controller/UserController.java b/src/main/java/in/koreatech/koin/domain/user/controller/UserController.java
index 865d91d1fa..5876922aa7 100644
--- a/src/main/java/in/koreatech/koin/domain/user/controller/UserController.java
+++ b/src/main/java/in/koreatech/koin/domain/user/controller/UserController.java
@@ -6,6 +6,7 @@
 
 import java.net.URI;
 
+import org.springframework.http.HttpStatusCode;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -13,12 +14,14 @@
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
 
-import in.koreatech.koin.domain.user.dto.AuthTokenRequest;
 import in.koreatech.koin.domain.user.dto.AuthResponse;
+import in.koreatech.koin.domain.user.dto.AuthTokenRequest;
 import in.koreatech.koin.domain.user.dto.EmailCheckExistsRequest;
+import in.koreatech.koin.domain.user.dto.FindPasswordRequest;
 import in.koreatech.koin.domain.user.dto.NicknameCheckExistsRequest;
 import in.koreatech.koin.domain.user.dto.StudentRegisterRequest;
 import in.koreatech.koin.domain.user.dto.StudentResponse;
@@ -26,13 +29,14 @@
 import in.koreatech.koin.domain.user.dto.StudentUpdateResponse;
 import in.koreatech.koin.domain.user.dto.UserLoginRequest;
 import in.koreatech.koin.domain.user.dto.UserLoginResponse;
+import in.koreatech.koin.domain.user.dto.UserPasswordChangeRequest;
 import in.koreatech.koin.domain.user.dto.UserTokenRefreshRequest;
 import in.koreatech.koin.domain.user.dto.UserTokenRefreshResponse;
-
 import in.koreatech.koin.domain.user.service.StudentService;
 import in.koreatech.koin.domain.user.service.UserService;
 import in.koreatech.koin.global.auth.Auth;
 import in.koreatech.koin.global.host.ServerURL;
+import io.swagger.v3.oas.annotations.Hidden;
 import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 
@@ -105,7 +109,8 @@ public ResponseEntity<Void> checkUserEmailExist(
     @PostMapping("/user/student/register")
     public ResponseEntity<Void> studentRegister(
         @Valid @RequestBody StudentRegisterRequest request,
-        @ServerURL String serverURL) {
+        @ServerURL String serverURL
+    ) {
         studentService.studentRegister(request, serverURL);
         return ResponseEntity.ok().build();
     }
@@ -134,4 +139,31 @@ public ResponseEntity<AuthResponse> getAuth(
         AuthResponse authResponse = userService.getAuth(userId);
         return ResponseEntity.ok().body(authResponse);
     }
+
+    @PostMapping("/user/find/password")
+    public ResponseEntity<Void> findPassword(
+        @RequestBody @Valid FindPasswordRequest request,
+        @ServerURL String serverURL
+    ) {
+        studentService.findPassword(request, serverURL);
+        return new ResponseEntity<>(HttpStatusCode.valueOf(201));
+    }
+
+    @GetMapping("/user/change/password/config")
+    public ModelAndView checkResetToken(
+        @ServerURL String serverUrl,
+        @RequestParam("reset_token") String resetToken
+    ) {
+        return studentService.checkResetToken(resetToken, serverUrl);
+    }
+
+    @Hidden
+    @PostMapping("/user/change/password/submit")
+    public ResponseEntity<Void> changePassword(
+        @RequestBody UserPasswordChangeRequest request,
+        @RequestParam("reset_token") String resetToken
+    ) {
+        studentService.changePassword(request, resetToken);
+        return ResponseEntity.ok().build();
+    }
 }
diff --git a/src/main/java/in/koreatech/koin/domain/user/dto/AuthTokenRequest.java b/src/main/java/in/koreatech/koin/domain/user/dto/AuthTokenRequest.java
index 99db18e625..7f73ce918b 100644
--- a/src/main/java/in/koreatech/koin/domain/user/dto/AuthTokenRequest.java
+++ b/src/main/java/in/koreatech/koin/domain/user/dto/AuthTokenRequest.java
@@ -1,6 +1,6 @@
 package in.koreatech.koin.domain.user.dto;
 
-import static com.fasterxml.jackson.databind.PropertyNamingStrategies.*;
+import static com.fasterxml.jackson.databind.PropertyNamingStrategies.SnakeCaseStrategy;
 
 import com.fasterxml.jackson.databind.annotation.JsonNaming;
 
diff --git a/src/main/java/in/koreatech/koin/domain/user/dto/FindPasswordRequest.java b/src/main/java/in/koreatech/koin/domain/user/dto/FindPasswordRequest.java
new file mode 100644
index 0000000000..a71d88aeec
--- /dev/null
+++ b/src/main/java/in/koreatech/koin/domain/user/dto/FindPasswordRequest.java
@@ -0,0 +1,19 @@
+package in.koreatech.koin.domain.user.dto;
+
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotNull;
+
+public record FindPasswordRequest(
+    @Email(message = "아우누리 계정 형식이 아닙니다. ${validatedValue}")
+    @NotNull(message = "이메일은 비어있을 수 없습니다.")
+    @Schema(description = "이메일 주소", requiredMode = REQUIRED, example = "asdf@koreatech.ac.kr")
+    @JsonProperty(value = "address")
+    String email
+) {
+
+}
diff --git a/src/main/java/in/koreatech/koin/domain/user/dto/StudentRegisterRequest.java b/src/main/java/in/koreatech/koin/domain/user/dto/StudentRegisterRequest.java
index d4f82f5bd9..eec39acc97 100644
--- a/src/main/java/in/koreatech/koin/domain/user/dto/StudentRegisterRequest.java
+++ b/src/main/java/in/koreatech/koin/domain/user/dto/StudentRegisterRequest.java
@@ -1,6 +1,6 @@
 package in.koreatech.koin.domain.user.dto;
 
-import static com.fasterxml.jackson.databind.PropertyNamingStrategies.*;
+import static com.fasterxml.jackson.databind.PropertyNamingStrategies.SnakeCaseStrategy;
 
 import java.time.Clock;
 import java.time.LocalDateTime;
diff --git a/src/main/java/in/koreatech/koin/domain/user/dto/UserPasswordChangeRequest.java b/src/main/java/in/koreatech/koin/domain/user/dto/UserPasswordChangeRequest.java
new file mode 100644
index 0000000000..e35a849a90
--- /dev/null
+++ b/src/main/java/in/koreatech/koin/domain/user/dto/UserPasswordChangeRequest.java
@@ -0,0 +1,11 @@
+package in.koreatech.koin.domain.user.dto;
+
+import com.fasterxml.jackson.databind.PropertyNamingStrategies.SnakeCaseStrategy;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+@JsonNaming(SnakeCaseStrategy.class)
+public record UserPasswordChangeRequest(
+    String password
+) {
+
+}
diff --git a/src/main/java/in/koreatech/koin/domain/user/exception/UserResetTokenExpiredException.java b/src/main/java/in/koreatech/koin/domain/user/exception/UserResetTokenExpiredException.java
new file mode 100644
index 0000000000..7e81539278
--- /dev/null
+++ b/src/main/java/in/koreatech/koin/domain/user/exception/UserResetTokenExpiredException.java
@@ -0,0 +1,17 @@
+package in.koreatech.koin.domain.user.exception;
+
+import in.koreatech.koin.global.auth.exception.AuthenticationException;
+
+public class UserResetTokenExpiredException extends AuthenticationException {
+
+    private static final String DEFAULT_MESSAGE = "비밀번호 재설정 토큰이 만료되었습니다.";
+
+    public UserResetTokenExpiredException(String message) {
+        super(message);
+    }
+
+    public static UserResetTokenExpiredException withDetail(String detail) {
+        String message = String.format("%s %s", DEFAULT_MESSAGE, detail);
+        return new UserResetTokenExpiredException(message);
+    }
+}
diff --git a/src/main/java/in/koreatech/koin/domain/user/model/AuthResult.java b/src/main/java/in/koreatech/koin/domain/user/model/AuthResult.java
index ad32e8229b..2b94b71804 100644
--- a/src/main/java/in/koreatech/koin/domain/user/model/AuthResult.java
+++ b/src/main/java/in/koreatech/koin/domain/user/model/AuthResult.java
@@ -24,7 +24,7 @@ public ModelAndView toModelAndViewForStudent() {
             if (user.getAuthExpiredAt().isBefore(LocalDateTime.now(clock))) {
                 return createErrorModelAndView("이미 만료된 토큰입니다.");
             }
-            if (!user.getIsAuthed()) {
+            if (!user.isAuthed()) {
                 user.auth();
                 eventPublisher.publishEvent(new StudentRegisterEvent(user.getEmail()));
                 return createSuccessModelAndView();
diff --git a/src/main/java/in/koreatech/koin/domain/user/model/User.java b/src/main/java/in/koreatech/koin/domain/user/model/User.java
index 15f7cd3e5c..e01ad74601 100644
--- a/src/main/java/in/koreatech/koin/domain/user/model/User.java
+++ b/src/main/java/in/koreatech/koin/domain/user/model/User.java
@@ -2,12 +2,14 @@
 
 import static lombok.AccessLevel.PROTECTED;
 
+import java.time.Clock;
 import java.time.LocalDateTime;
 
 import org.hibernate.annotations.SQLDelete;
 import org.hibernate.annotations.Where;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
+import in.koreatech.koin.domain.user.exception.UserResetTokenExpiredException;
 import in.koreatech.koin.global.config.LocalDateTimeAttributeConverter;
 import in.koreatech.koin.global.domain.BaseEntity;
 import jakarta.persistence.Column;
@@ -33,6 +35,7 @@
 @SQLDelete(sql = "UPDATE users SET is_deleted = true WHERE id = ?")
 @NoArgsConstructor(access = PROTECTED)
 public class User extends BaseEntity {
+
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
@@ -70,7 +73,7 @@ public class User extends BaseEntity {
 
     @NotNull
     @Column(name = "is_authed", nullable = false)
-    private Boolean isAuthed = false;
+    private boolean isAuthed = false;
 
     @Column(name = "last_logged_at")
     private LocalDateTime lastLoggedAt;
@@ -87,16 +90,16 @@ public class User extends BaseEntity {
     @Column(name = "auth_token")
     private String authToken;
 
-    @Column(name = "auth_expired_at")
     @Convert(converter = LocalDateTimeAttributeConverter.class)
+    @Column(name = "auth_expired_at")
     private LocalDateTime authExpiredAt;
 
     @Size(max = 255)
     @Column(name = "reset_token")
     private String resetToken;
 
-    @Column(name = "reset_expired_at")
     @Convert(converter = LocalDateTimeAttributeConverter.class)
+    @Column(name = "reset_expired_at")
     private LocalDateTime resetExpiredAt;
 
     @Column(name = "device_token", nullable = true)
@@ -104,9 +107,10 @@ public class User extends BaseEntity {
 
     @Builder
     private User(String password, String nickname, String name, String phoneNumber, UserType userType,
-        String email, UserGender gender, Boolean isAuthed, LocalDateTime lastLoggedAt, String profileImageUrl,
-        Boolean isDeleted, String authToken, LocalDateTime authExpiredAt, String resetToken, LocalDateTime resetExpiredAt,
-        String deviceToken) {
+                 String email, UserGender gender, boolean isAuthed, LocalDateTime lastLoggedAt, String profileImageUrl,
+                 Boolean isDeleted, String authToken, LocalDateTime authExpiredAt, String resetToken,
+                 LocalDateTime resetExpiredAt,
+                 String deviceToken) {
         this.password = password;
         this.nickname = nickname;
         this.name = name;
@@ -145,6 +149,11 @@ public void updatePassword(PasswordEncoder passwordEncoder, String password) {
         this.password = passwordEncoder.encode(password);
     }
 
+    public void generateResetTokenForFindPassword(Clock clock) {
+        this.resetExpiredAt = LocalDateTime.now(clock).plusHours(1);
+        this.resetToken = this.email + this.resetExpiredAt;
+    }
+
     public void update(String nickname, String name, String phoneNumber, UserGender gender) {
         this.nickname = nickname;
         this.name = name;
@@ -155,4 +164,10 @@ public void update(String nickname, String name, String phoneNumber, UserGender
     public void auth() {
         this.isAuthed = true;
     }
+
+    public void validateResetToken() {
+        if (resetExpiredAt.isBefore(LocalDateTime.now())) {
+            throw UserResetTokenExpiredException.withDetail("resetToken: " + resetToken);
+        }
+    }
 }
diff --git a/src/main/java/in/koreatech/koin/domain/user/repository/UserRepository.java b/src/main/java/in/koreatech/koin/domain/user/repository/UserRepository.java
index 168b8f0d15..d14a1a23bd 100644
--- a/src/main/java/in/koreatech/koin/domain/user/repository/UserRepository.java
+++ b/src/main/java/in/koreatech/koin/domain/user/repository/UserRepository.java
@@ -19,6 +19,8 @@ public interface UserRepository extends Repository<User, Long> {
 
     Optional<User> findByAuthToken(String authToken);
 
+    Optional<User> findAllByResetToken(String resetToken);
+
     default User getByEmail(String email) {
         return findByEmail(email)
             .orElseThrow(() -> UserNotFoundException.withDetail("email: " + email));
@@ -34,6 +36,11 @@ default User getByNickname(String nickname) {
             .orElseThrow(() -> UserNotFoundException.withDetail("nickname: " + nickname));
     }
 
+    default User getByResetToken(String resetToken) {
+        return findAllByResetToken(resetToken)
+            .orElseThrow(() -> UserNotFoundException.withDetail("resetToken: " + resetToken));
+    }
+
     boolean existsByNickname(String nickname);
 
     void delete(User user);
diff --git a/src/main/java/in/koreatech/koin/domain/user/service/StudentService.java b/src/main/java/in/koreatech/koin/domain/user/service/StudentService.java
index 7133445aca..fee01fd929 100644
--- a/src/main/java/in/koreatech/koin/domain/user/service/StudentService.java
+++ b/src/main/java/in/koreatech/koin/domain/user/service/StudentService.java
@@ -11,10 +11,12 @@
 import org.springframework.web.servlet.ModelAndView;
 
 import in.koreatech.koin.domain.user.dto.AuthTokenRequest;
+import in.koreatech.koin.domain.user.dto.FindPasswordRequest;
 import in.koreatech.koin.domain.user.dto.StudentRegisterRequest;
 import in.koreatech.koin.domain.user.dto.StudentResponse;
 import in.koreatech.koin.domain.user.dto.StudentUpdateRequest;
 import in.koreatech.koin.domain.user.dto.StudentUpdateResponse;
+import in.koreatech.koin.domain.user.dto.UserPasswordChangeRequest;
 import in.koreatech.koin.domain.user.exception.DuplicationNicknameException;
 import in.koreatech.koin.domain.user.exception.StudentDepartmentNotValidException;
 import in.koreatech.koin.domain.user.exception.StudentNumberNotValidException;
@@ -27,6 +29,7 @@
 import in.koreatech.koin.domain.user.repository.StudentRepository;
 import in.koreatech.koin.domain.user.repository.UserRepository;
 import in.koreatech.koin.global.domain.email.exception.DuplicationEmailException;
+import in.koreatech.koin.global.domain.email.form.StudentPasswordChangeData;
 import in.koreatech.koin.global.domain.email.form.StudentRegistrationData;
 import in.koreatech.koin.global.domain.email.model.EmailAddress;
 import in.koreatech.koin.global.domain.email.service.MailService;
@@ -121,10 +124,33 @@ private void validateStudentNumber(String studentNumber) {
         if (studentNumber == null) {
             return;
         }
-        Integer studentNumberYear = Student.parseStudentNumberYear(studentNumber);
+        int studentNumberYear = Student.parseStudentNumberYear(studentNumber);
         if (studentNumberYear < 1992
-            || new LocalDateTime().now().getYear() < studentNumberYear) {
+            || LocalDateTime.now().getYear() < studentNumberYear) {
             throw StudentNumberNotValidException.withDetail("studentNumber: " + studentNumber);
         }
     }
+
+    @Transactional
+    public void findPassword(FindPasswordRequest request, String serverURL) {
+        User user = userRepository.getByEmail(request.email());
+        user.generateResetTokenForFindPassword(clock);
+        User authedUser = userRepository.save(user);
+        mailService.sendMail(request.email(), new StudentPasswordChangeData(serverURL, authedUser.getResetToken()));
+    }
+
+    public ModelAndView checkResetToken(String resetToken, String serverUrl) {
+        ModelAndView modelAndView = new ModelAndView("change_password_config");
+        modelAndView.addObject("contextPath", serverUrl);
+        modelAndView.addObject("resetToken", resetToken);
+        return modelAndView;
+    }
+
+    @Transactional
+    public void changePassword(UserPasswordChangeRequest request, String resetToken) {
+        User authedUser = userRepository.getByResetToken(resetToken);
+        authedUser.validateResetToken();
+        authedUser.updatePassword(passwordEncoder, request.password());
+        userRepository.save(authedUser);
+    }
 }
diff --git a/src/main/java/in/koreatech/koin/global/config/LocalDateTimeAttributeConverter.java b/src/main/java/in/koreatech/koin/global/config/LocalDateTimeAttributeConverter.java
index 7844827154..d9c36be94f 100644
--- a/src/main/java/in/koreatech/koin/global/config/LocalDateTimeAttributeConverter.java
+++ b/src/main/java/in/koreatech/koin/global/config/LocalDateTimeAttributeConverter.java
@@ -13,15 +13,17 @@ public class LocalDateTimeAttributeConverter implements AttributeConverter<Local
 
     @Override
     public String convertToDatabaseColumn(LocalDateTime localDateTime) {
-        if (localDateTime == null)
+        if (localDateTime == null) {
             return null;
+        }
         return localDateTime.format(formatter);
     }
 
     @Override
     public LocalDateTime convertToEntityAttribute(String dbData) {
-        if (dbData == null)
+        if (dbData == null) {
             return null;
+        }
         return LocalDateTime.parse(dbData, formatter);
     }
 }
diff --git a/src/main/java/in/koreatech/koin/global/config/WebConfig.java b/src/main/java/in/koreatech/koin/global/config/WebConfig.java
index 9656e4fb7c..951f30ea86 100644
--- a/src/main/java/in/koreatech/koin/global/config/WebConfig.java
+++ b/src/main/java/in/koreatech/koin/global/config/WebConfig.java
@@ -1,6 +1,5 @@
 package in.koreatech.koin.global.config;
 
-
 import java.util.List;
 
 import org.springframework.context.annotation.Configuration;
diff --git a/src/main/java/in/koreatech/koin/global/domain/email/form/StudentPasswordChangeData.java b/src/main/java/in/koreatech/koin/global/domain/email/form/StudentPasswordChangeData.java
new file mode 100644
index 0000000000..3abb90d046
--- /dev/null
+++ b/src/main/java/in/koreatech/koin/global/domain/email/form/StudentPasswordChangeData.java
@@ -0,0 +1,34 @@
+package in.koreatech.koin.global.domain.email.form;
+
+import java.util.Map;
+
+public class StudentPasswordChangeData implements MailFormData {
+    private static final String SUBJECT = "코인 패스워드 초기화 인증";
+    private static final String PATH = "student_change_password_certificate_button";
+
+    private final String contextPath;
+    private final String resetToken;
+
+    public StudentPasswordChangeData(String contextPath, String resetToken) {
+        this.contextPath = contextPath;
+        this.resetToken = resetToken;
+    }
+
+    @Override
+    public Map<String, String> getContent() {
+        return Map.of(
+            "contextPath", contextPath,
+            "resetToken", resetToken
+        );
+    }
+
+    @Override
+    public String getSubject() {
+        return SUBJECT;
+    }
+
+    @Override
+    public String getFilePath() {
+        return PATH;
+    }
+}
diff --git a/src/main/java/in/koreatech/koin/global/host/ServerURLArgumentResolver.java b/src/main/java/in/koreatech/koin/global/host/ServerURLArgumentResolver.java
index 815159613b..7f6dbe43e7 100644
--- a/src/main/java/in/koreatech/koin/global/host/ServerURLArgumentResolver.java
+++ b/src/main/java/in/koreatech/koin/global/host/ServerURLArgumentResolver.java
@@ -22,8 +22,7 @@ public boolean supportsParameter(MethodParameter parameter) {
 
     @Override
     public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
-        NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
-
+                                  NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
         return serverURLContext.getServerURL();
     }
 }
diff --git a/src/main/resources/mail/change_password_config.html b/src/main/resources/mail/change_password_config.html
new file mode 100644
index 0000000000..163452dcd1
--- /dev/null
+++ b/src/main/resources/mail/change_password_config.html
@@ -0,0 +1,63 @@
+<!doctype html>
+<html lang="ko">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+  <title>코인 이메일 인증 폼</title>
+  <link rel="shortcut icon" type="image/ico" href="https://static.koreatech.in/favicon.ico"/>
+</head>
+
+<body style="margin: 0; padding: 0;">
+<table align="center" border="0" cellpadding="0" cellspacing="0" width="600"
+       style="border: 1px solid #cccccc;">
+  <tr>
+    <td align="center" bgcolor="#EAEAEA" style="padding: 40px 0 30px 0;">
+      <img src="https://static.koreatech.in/mail_form_logo.png" alt="Creating Email Magic"
+           width="300"
+           height="295" style="display: block;"/>
+    </td>
+  </tr>
+  <tr>
+    <td bgcolor="#ffffff" style="padding: 40px 30px 40px 30px;">
+      <table border="0" cellpadding="0" cellspacing="0" width="100%">
+        <tr>
+          <td style="color: #153643; font-family: Arial, sans-serif; font-size: 24px; text-align: center;">
+            <b>비밀번호 변경 안내</b>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding: 20px 0 30px 0; text-align: center; font-family: Arial, sans-serif;">
+            안녕하세요.<br><br>
+            한국기술교육대학교 커뮤니티 코인 운영팀입니다.<br>
+            <br>
+            패스워드를 입력해주세요.(6자이상 18자 이하의 특수문자를 포함)<br><br>
+            <div>
+              <input type="hidden" id="requestUrl" name="requestUrl"
+                     th:value="@{|${contextPath}/user/change/password/submit?reset_token=${resetToken}|}"/>
+              비밀번호 입력 : <input type="password" id="password" name="userPw"/><br><br>
+              비밀번호 확인 : <input type="password" id="password_confirm" name="userPwConfirm"/><br><br>
+              <input type="button" value="비밀번호 변경" id="submitButton"/><br><br>
+            </div>
+          </td>
+        </tr>
+
+      </table>
+    </td>
+  </tr>
+  <tr>
+    <td bgcolor="#2F2F2F" style="padding: 30px 30px 30px 30px;">
+      <table border="0" cellpadding="0" cellspacing="0" width="100%">
+        <tr>
+          <td width="75%" style="color:white; font-family: Arial, sans-serif;">
+            Copyright BCSD Lab, TEAM_KAP All rights reserved.
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
+<script src="/js/sha256.min.js"></script>
+<script src="/js/password.check.js"></script>
+</body>
+</html>
diff --git a/src/main/resources/mail/student_change_password_certificate_button.html b/src/main/resources/mail/student_change_password_certificate_button.html
new file mode 100644
index 0000000000..9617aba32f
--- /dev/null
+++ b/src/main/resources/mail/student_change_password_certificate_button.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+    <title>코인 이메일 인증 폼</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+</head>
+
+<body style="margin: 0; padding: 0;">
+<table align="center" border="0" cellpadding="0" cellspacing="0" width="600" style="border: 1px solid #cccccc;">
+    <tr>
+        <td align="center" bgcolor="#EAEAEA" style="padding: 40px 0 30px 0;">
+            <img src="https://static.koreatech.in/mail_form_logo.png" alt="Creating Email Magic" width="300"
+                 height="295" style="display: block;"/>
+        </td>
+    </tr>
+    <tr>
+        <td bgcolor="#ffffff" style="padding: 40px 30px 40px 30px;">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%">
+                <tr>
+                    <td style="color: #153643; font-family: Arial, sans-serif; font-size: 24px; text-align: center;">
+                        <b>계정 비밀번호 변경 인증</b>
+                    </td>
+                </tr>
+                <tr>
+                    <td style="padding: 20px 0 30px 0; text-align: center; font-family: Arial, sans-serif;">
+                        안녕하세요.<br><br>
+                        한국기술교육대학교 커뮤니티 코인 운영팀입니다.<br>
+                        <br>
+                        비밀번호를 변경하려면 아래 버튼을 클릭하세요.<br><br>
+
+                        <a style="background-color: #005C92;
+                        border: none;
+                        border-radius: 25px;
+                        color: white;
+                        padding: 15px 32px;
+                        text-align: center;
+                        text-decoration: none;
+                        display: inline-block;
+                        font-size: 16px;" class="btn"
+                           th:href="@{|${contextPath}/user/change/password/config?reset_token=${resetToken}|}"><b>비밀번호
+                            변경하기</b></a>
+                    </td>
+                </tr>
+            </table>
+        </td>
+    </tr>
+    <tr>
+        <td bgcolor="#2F2F2F" style="padding: 30px 30px 30px 30px;">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%">
+                <tr>
+                    <td width="75%" style="color:white; font-family: Arial, sans-serif;">
+                        Copyright BCSD Lab All rights reserved.
+                    </td>
+
+                </tr>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>
diff --git a/src/main/resources/static/js/password.check.js b/src/main/resources/static/js/password.check.js
new file mode 100644
index 0000000000..58eee4a123
--- /dev/null
+++ b/src/main/resources/static/js/password.check.js
@@ -0,0 +1,48 @@
+function validatePasswordFormat(password) {
+  var regExp = new RegExp(
+      '^(?=.*[a-zA-Z])(?=.*[!@#$%^*+=-])(?=.*[0-9]).{6,18}$', 'g');
+  if (!regExp.exec(password)) {
+    return false;
+  }
+  return true;
+}
+
+var $userPw = $('#password');
+var $userPwConfirm = $('#password_confirm');
+var $requestUrl = $('#requestUrl');
+
+$("#submitButton").click(function () {
+  var userPw = $.trim($userPw.val());
+  var userPwConfirm = $.trim($userPwConfirm.val());
+
+  if (userPw !== userPwConfirm) {
+    alert('패스워드가 일치하지 않습니다. 다시 입력해주세요.');
+    return false;
+  }
+
+  if (validatePasswordFormat(userPw) === false) {
+    alert('특수문자를 포함한 영어와 숫자 6~18 자리를 입력하세요');
+    return false;
+  }
+
+  $.ajax({
+    url: $requestUrl.val(),
+    type: 'post',
+    contentType: 'application/json; charset=utf-8',
+    data: JSON.stringify({password: sha256(userPw)}),
+    success: function (response) {
+      alert('비밀번호 변경 성공!\n변경된 비밀번호로 로그인해주세요.');
+      location.href = '//koreatech.in';
+    },
+    error: function (jqXHR, textStatus, errorThrown) {
+      if (jqXHR.status === 401) {
+        // 401 에러에 대한 특정 로직
+        alert('유효시간이 만료되었습니다.\n메일을 재전송하여 진행해주세요.');
+      } else {
+        // 기타 에러 처리
+        alert('서버와의 통신 중 오류가 발생했습니다.');
+      }
+    }
+  });
+  return false;
+});
diff --git a/src/main/resources/static/js/sha256.min.js b/src/main/resources/static/js/sha256.min.js
new file mode 100644
index 0000000000..becbd72b0b
--- /dev/null
+++ b/src/main/resources/static/js/sha256.min.js
@@ -0,0 +1 @@
+var sha256=function a(b){function c(a,b){return a>>>b|a<<32-b}for(var d,e,f=Math.pow,g=f(2,32),h="length",i="",j=[],k=8*b[h],l=a.h=a.h||[],m=a.k=a.k||[],n=m[h],o={},p=2;64>n;p++)if(!o[p]){for(d=0;313>d;d+=p)o[d]=p;l[n]=f(p,.5)*g|0,m[n++]=f(p,1/3)*g|0}for(b+="\x80";b[h]%64-56;)b+="\x00";for(d=0;d<b[h];d++){if(e=b.charCodeAt(d),e>>8)return;j[d>>2]|=e<<(3-d)%4*8}for(j[j[h]]=k/g|0,j[j[h]]=k,e=0;e<j[h];){var q=j.slice(e,e+=16),r=l;for(l=l.slice(0,8),d=0;64>d;d++){var s=q[d-15],t=q[d-2],u=l[0],v=l[4],w=l[7]+(c(v,6)^c(v,11)^c(v,25))+(v&l[5]^~v&l[6])+m[d]+(q[d]=16>d?q[d]:q[d-16]+(c(s,7)^c(s,18)^s>>>3)+q[d-7]+(c(t,17)^c(t,19)^t>>>10)|0),x=(c(u,2)^c(u,13)^c(u,22))+(u&l[1]^u&l[2]^l[1]&l[2]);l=[w+x|0].concat(l),l[4]=l[4]+w|0}for(d=0;8>d;d++)l[d]=l[d]+r[d]|0}for(d=0;8>d;d++)for(e=3;e+1;e--){var y=l[d]>>8*e&255;i+=(16>y?0:"")+y.toString(16)}return i};
\ No newline at end of file
diff --git a/src/test/java/in/koreatech/koin/acceptance/OwnerApiTest.java b/src/test/java/in/koreatech/koin/acceptance/OwnerApiTest.java
index 3703692b63..9c49da395b 100644
--- a/src/test/java/in/koreatech/koin/acceptance/OwnerApiTest.java
+++ b/src/test/java/in/koreatech/koin/acceptance/OwnerApiTest.java
@@ -282,7 +282,7 @@ protected void doInTransactionWithoutResult(TransactionStatus status) {
                             softly.assertThat(owner.getAttachments().size()).isEqualTo(1);
                             softly.assertThat(owner.getAttachments().get(0).getUrl())
                                 .isEqualTo("https://static.koreatech.in/testimage.png");
-                            softly.assertThat(owner.getUser().getIsAuthed()).isFalse();
+                            softly.assertThat(owner.getUser().isAuthed()).isFalse();
                             softly.assertThat(owner.getUser().getIsDeleted()).isFalse();
                             verify(ownerEventListener).onOwnerRegister(any());
                         }
diff --git a/src/test/java/in/koreatech/koin/acceptance/UserApiTest.java b/src/test/java/in/koreatech/koin/acceptance/UserApiTest.java
index 1e327c1ffe..436189e5d3 100644
--- a/src/test/java/in/koreatech/koin/acceptance/UserApiTest.java
+++ b/src/test/java/in/koreatech/koin/acceptance/UserApiTest.java
@@ -5,7 +5,8 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.SoftAssertions.assertSoftly;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import java.time.Clock;
 import java.time.ZonedDateTime;
@@ -764,7 +765,7 @@ protected void doInTransactionWithoutResult(TransactionStatus status) {
                         softly.assertThat(student.getUser().getPhoneNumber()).isEqualTo("010-0000-0000");
                         softly.assertThat(student.getUser().getUserType()).isEqualTo(STUDENT);
                         softly.assertThat(student.getUser().getEmail()).isEqualTo("koko123@koreatech.ac.kr");
-                        softly.assertThat(student.getUser().getIsAuthed()).isEqualTo(false);
+                        softly.assertThat(student.getUser().isAuthed()).isEqualTo(false);
                         softly.assertThat(student.getStudentNumber()).isEqualTo("2021136012");
                         softly.assertThat(student.getDepartment()).isEqualTo(Dept.COMPUTER_SCIENCE.getName());
                         softly.assertThat(student.getAnonymousNickname()).isNotNull();
@@ -809,7 +810,7 @@ void authenticate() {
 
         User user1 = userRepository.getByEmail("koko123@koreatech.ac.kr");
 
-        Assertions.assertThat(user1.getIsAuthed()).isEqualTo(true);
+        Assertions.assertThat(user1.isAuthed()).isTrue();
         verify(studentEventListener).onStudentRegister(any());
     }