diff --git a/src/main/java/de/ph87/tools/common/EmailHelper.java b/src/main/java/de/ph87/tools/common/EmailHelper.java
new file mode 100644
index 0000000..d8ccbdd
--- /dev/null
+++ b/src/main/java/de/ph87/tools/common/EmailHelper.java
@@ -0,0 +1,28 @@
+package de.ph87.tools.common;
+
+import lombok.NonNull;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public class EmailHelper {
+
+  private static final Pattern REGEX = Pattern.compile("(?<username>(?<usernameFirst>[^@])[^@]*)@(?<domain>(?<domainFirst>[^.]).*(?<tld>\\.[^.]+))");
+
+  public static boolean isEmailValid(@NonNull final String email) {
+    return REGEX.matcher(email).matches();
+  }
+
+  @NonNull
+  public static String obfuscateEmail(@NonNull final String email) {
+    final Matcher matcher = REGEX.matcher(email);
+    if (!matcher.find()) {
+      return "";
+    }
+    final String usernameFirst = matcher.group("usernameFirst");
+    final String domainFirst = matcher.group("domainFirst");
+    final String tld = matcher.group("tld");
+    return "%s...@%s...%s".formatted(usernameFirst, domainFirst, tld);
+  }
+
+}
diff --git a/src/main/java/de/ph87/tools/user/User.java b/src/main/java/de/ph87/tools/user/User.java
index efe812e..fb6916f 100644
--- a/src/main/java/de/ph87/tools/user/User.java
+++ b/src/main/java/de/ph87/tools/user/User.java
@@ -72,6 +72,12 @@ public class User extends UserPublicAbstract {
   @Column(nullable = false)
   private String password = "";
 
+  @Setter
+  @NonNull
+  @ToString.Exclude
+  @Column(nullable = false)
+  private String email = "";
+
   public User(@NonNull final String name) {
     this.name = name;
   }
diff --git a/src/main/java/de/ph87/tools/user/UserController.java b/src/main/java/de/ph87/tools/user/UserController.java
index 36da9f9..b3f4c8b 100644
--- a/src/main/java/de/ph87/tools/user/UserController.java
+++ b/src/main/java/de/ph87/tools/user/UserController.java
@@ -49,6 +49,12 @@ public class UserController {
     return userService.changePassword(userUuid, password);
   }
 
+  @NonNull
+  @PostMapping("changeEmail")
+  public UserPrivateDto changeEmail(@NonNull final UserPrivateUuid userUuid, @NonNull @RequestBody final String email) {
+    return userService.changeEmail(userUuid, email);
+  }
+
   @GetMapping("delete")
   public void delete(@NonNull final UserPrivateUuid userUuid, @NonNull final HttpServletResponse response) {
     userService.delete(userUuid, response);
diff --git a/src/main/java/de/ph87/tools/user/UserPrivateDto.java b/src/main/java/de/ph87/tools/user/UserPrivateDto.java
index 38ac322..fb10c8f 100644
--- a/src/main/java/de/ph87/tools/user/UserPrivateDto.java
+++ b/src/main/java/de/ph87/tools/user/UserPrivateDto.java
@@ -12,6 +12,8 @@ import lombok.ToString;
 
 import java.time.ZonedDateTime;
 
+import static de.ph87.tools.common.EmailHelper.obfuscateEmail;
+
 @Getter
 @ToString
 public class UserPrivateDto extends UserPublicAbstract {
@@ -35,6 +37,8 @@ public class UserPrivateDto extends UserPublicAbstract {
 
   private final boolean password;
 
+  private final String email;
+
   private final boolean admin;
 
   public UserPrivateDto(@NonNull final User user) {
@@ -43,6 +47,7 @@ public class UserPrivateDto extends UserPublicAbstract {
     this.name = user.getName();
     this.created = user.getCreated();
     this.password = !user.getPassword().isEmpty();
+    this.email = obfuscateEmail(user.getEmail());
     this.admin = user.isAdmin();
   }
 
diff --git a/src/main/java/de/ph87/tools/user/UserService.java b/src/main/java/de/ph87/tools/user/UserService.java
index 2455038..b1707cb 100644
--- a/src/main/java/de/ph87/tools/user/UserService.java
+++ b/src/main/java/de/ph87/tools/user/UserService.java
@@ -25,6 +25,7 @@ import java.util.Random;
 import java.util.function.Consumer;
 import java.util.regex.Pattern;
 
+import static de.ph87.tools.common.EmailHelper.isEmailValid;
 import static de.ph87.tools.user.uuid.UserPrivateUuidArgumentResolver.USER_UUID_COOKIE_NAME;
 
 @Slf4j
@@ -131,6 +132,18 @@ public class UserService {
     });
   }
 
+  @NonNull
+  public UserPrivateDto changeEmail(@NonNull final UserPrivateUuid privateUuid, @NonNull final String email) {
+    return modify(privateUuid, user -> {
+      if (!isEmailValid(email)) {
+        log.warn("Cannot change User email: not valid, user={}", user);
+        throw new ResponseStatusException(HttpStatus.BAD_REQUEST);
+      }
+      user.setEmail(email);
+      log.info("User email changed: user={}", user);
+    });
+  }
+
   public void delete(@NonNull final UserPrivateUuid privateUuid, @NonNull final HttpServletResponse response) {
     final User user = userRepository.findByPrivateUuid(privateUuid.uuid).orElseThrow(() -> new ResponseStatusException(HttpStatus.BAD_REQUEST));
     deleteUnchecked(response, user);