diff --git a/craftui/craftui.py b/craftui/craftui.py
index 5088c20..1bcd704 100755
--- a/craftui/craftui.py
+++ b/craftui/craftui.py
@@ -171,14 +171,24 @@
   example = '******'
 
   def Validate(self, value):
-    super(VPassword, self).Validate(value)
-    pw = ''
+    # value is { admin: admin_pw, new: new_pw, confirm: confirm_pw }
+    # passwords are in base64
+    super(VPassword, self).Validate(value['new'])
+
+    # TODO(edjames) ascii decodes legally; how to check it's really base64?
     try:
-      pw = base64.b64decode(value)
+      current = base64.b64decode(self.admin)
+      admin_pw = base64.b64decode(value['admin'])
+      new_pw = base64.b64decode(value['new'])
     except TypeError:
       raise ConfigError('passwords must be base64 encoded')
-    # TODO(edjames) ascii decodes legally; how to check it's really base64?
-    if len(pw) < 5 or len(pw) > 16:
+
+    # verify correct admin pw is passed, confirm matches
+    if current != admin_pw:
+      raise ConfigError('admin password is incorrect')
+    if value['new'] != value['confirm']:
+      raise ConfigError('new password does not match confirm password')
+    if len(new_pw) < 5 or len(new_pw) > 16:
       raise ConfigError('passwords should be 5-16 characters')
 
 
@@ -194,6 +204,9 @@
   def Configure(self):
     raise Exception('override Config.Configure')
 
+  def SetUI(self, ui):
+    self.ui = ui
+
   @staticmethod
   def Run(command):
     """Run a command."""
@@ -216,6 +229,15 @@
     Config.Run(['ptp-config', '-s', self.key, self.validator.config])
 
 
+class PtpPassword(PtpConfig):
+  """Configure a password (need password_admin setting)."""
+
+  def Validate(self, value):
+    admin = self.ui.ReadFile('%s/config/settings/password_admin' % self.ui.sim)
+    self.validator.admin = admin
+    super(PtpPassword, self).Validate(value)
+
+
 class PtpActivate(Config):
   """Configure using ptp-config."""
 
@@ -266,8 +288,8 @@
   """A web server that configures and displays Chimera data."""
 
   handlers = {
-      'password_admin': PtpConfig(VPassword, 'password_admin'),
-      'password_guest': PtpConfig(VPassword, 'password_guest'),
+      'password_admin': PtpPassword(VPassword, 'password_admin'),
+      'password_guest': PtpPassword(VPassword, 'password_guest'),
 
       'craft_ipaddr': PtpConfig(VSlash, 'craft_ipaddr'),
       'link_ipaddr': PtpConfig(VSlash, 'local_ipaddr'),
@@ -344,6 +366,7 @@
           if k not in self.handlers:
             raise ConfigError('unknown key "%s"' % k)
           h = self.handlers[k]
+          h.SetUI(self)
           h.Validate(v)
       # do it again for real
       for c in conf:
diff --git a/craftui/craftui_test.sh b/craftui/craftui_test.sh
index dc71fe2..56be130 100755
--- a/craftui/craftui_test.sh
+++ b/craftui/craftui_test.sh
@@ -177,14 +177,25 @@
   check_success
 
   testname "password is base64"
-  d='{"config":[{"password_guest":"ZHVja3k="}]}'	# ducky
-  $curl $admin_auth -d $d $url/content.json |& grep '"error": 0}'
+  admin=$(echo -n admin | base64)
+  new=$(echo -n ducky | base64)
+  d='{ "config": [ { "password_guest": {
+        "admin": "'"$admin"'",
+        "new": "'"$new"'",
+        "confirm": "'"$new"'"
+      } } ] }'
+  $curl $admin_auth -d "$d" $url/content.json |& grep '"error": 0}'
   check_success
 
   # TODO(edjames): duckduck does not fail.  Need to catch that.
   testname "password not base64"
-  d='{"config":[{"password_guest":"abc123XXX"}]}'
-  $curl $admin_auth -d $d $url/content.json |& grep '"error": 1}'
+  new=ducky
+  d='{ "config": [ { "password_guest": {
+        "admin": "'"$admin"'",
+        "new": "'"$new"'",
+        "confirm": "'"$new"'"
+      } } ] }'
+  $curl $admin_auth -d "$d" $url/content.json |& grep '"error": 1}'
   check_success
 
   testname "process still running at end of test sequence"
diff --git a/craftui/www/config.thtml b/craftui/www/config.thtml
index 829bc96..7f87c26 100644
--- a/craftui/www/config.thtml
+++ b/craftui/www/config.thtml
@@ -22,170 +22,225 @@
     </section>
   </header>
   <br>
+
   <div class="tabs">
     <div class="tab">
       <input type="radio" id="tab-1" name="tab-group-1" checked>
-      <label for="tab-1">Site Configuration</label>
+      <label for="tab-1">Running Configuration</label>
       <div class="content">
-	<b>Platform Parameters:</b>
-	<table>
-	  <tr>
-	    <td align=center><b>Parameter
-	    <td align=center><b>Active Value
-	    <td align=center><b>Last Configured
-	    <td align=center><b>Configure
-	    <td align=center><b>Status
+        <b>Running Configuration:</b><br>
+        <textarea id=configuration cols=60 rows=30>...</textarea><br>
+        <input type=submit value=Apply onclick="CraftUI.config('password_admin', 0, 1)">
+      </div>
+    </div>
 
-	  <tr>
-	    <td><b>Craft IP Address
-	    <td align=right><span id="platform/active_craft_inet">...</span>
-	    <td align=right>
-	      <span id="platform/craft_ipaddr">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('craft_ipaddr', 1)">
-	    <td>
-	      <input id=craft_ipaddr type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('craft_ipaddr')">
-	    <td>
-	      <span id=craft_ipaddr_result>...</span>
+    <div class="tab">
+      <input type="radio" id="tab-2" name="tab-group-1">
+      <label for="tab-2">Passwords</label>
+      <div class="content">
+        <b>Passwords:</b>
+        <table>
+          <tr>
+            <td align=center><b>Account
+            <td align=center><b>Old, New and Confirmed Password
+            <td align=center><b>Status
 
-	  <tr>
-	    <td><b>Link IP Address
-	    <td align=right><span id="platform/active_link_inet">...</span>
-	    <td align=right>
-	      <span id="platform/link_ipaddr">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('link_ipaddr', 1)">
-	    <td>
-	      <input id=link_ipaddr type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('link_ipaddr')">
-	    <td>
-	      <span id=link_ipaddr_result>...</span>
+          <tr>
+            <td>
+              Admin
+            <td align=right>
+              Current <b>Admin</b> Password: <input id=password_admin_admin type=password value=""><br>
+              New Admin Password: <input id=password_admin_new type=password value=""><br>
+              Confirm: <input id=password_admin_confirm type=password value=""><br>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('password_admin', 0, 1)">
+            <td>
+              <span id=password_admin_result>...</span>
 
-	  <tr>
-	    <td><b>Peer IP Address
-	    <td align=right>See Peer
-	    <td align=right>
-	      <span id="platform/peer_ipaddr">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('peer_ipaddr', 1)">
-	    <td>
-	      <input id=peer_ipaddr type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('peer_ipaddr')">
-	    <td>
-	      <span id=peer_ipaddr_result>...</span>
+          <tr>
+            <td>
+              Guest
+            <td align=right>
+              Current <b>Admin</b> Password: <input id=password_guest_admin type=password value=""><br>
+              New Guest Password: <input id=password_guest_new type=password value=""><br>
+              Confirm: <input id=password_guest_confirm type=password value=""><br>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('password_guest', 0, 1)">
+            <td>
+              <span id=password_guest_result>...</span>
 
-	  <tr>
-	    <td><b>In-band Management VLAN
-	    <td align=right><span id="platform/active_inband_vlan">...</span>
-	    <td align=right>
-	      <span id="platform/vlan_inband">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_inband', 1)">
-	    <td>
-	      <input id=vlan_inband type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('vlan_inband')">
-	    <td>
-	      <span id=vlan_inband_result>...</span>
+        </table>
+      </div>
+    </div>
 
-	  <tr>
-	    <td><b>Out-of-band Management VLAN
-	    <td align=right><span id="platform/active_ooband_vlan">...</span>
-	    <td align=right>
-	      <span id="platform/vlan_ooband">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_ooband', 1)">
-	    <td>
-	      <input id=vlan_ooband type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('vlan_ooband')">
-	    <td>
-	      <span id=vlan_ooband_result>...</span>
+    <div class="tab">
+      <input type="radio" id="tab-3" name="tab-group-1">
+      <label for="tab-3">Network</label>
+      <div class="content">
+        <b>Platform Parameters:</b>
+        <table>
+          <tr>
+            <td align=center><b>Parameter
+            <td align=center><b>Active Value
+            <td align=center><b>Last Configured
+            <td align=center><b>Configure
+            <td align=center><b>Status
 
-	  <tr>
-	    <td><b>Link VLAN (to peer)
-	    <td align=right><span id="platform/active_link_vlan">...</span>
-	    <td align=right>
-	      <span id="platform/vlan_link">...</span>
-	      <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_peer', 1)">
-	    <td>
-	      <input id=vlan_peer type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('vlan_peer')">
-	    <td>
-	      <span id=vlan_peer_result>...</span>
+          <tr>
+            <td><b>Craft IP Address
+            <td align=right><span id="platform/active_craft_inet">...</span>
+            <td align=right>
+              <span id="platform/craft_ipaddr">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('craft_ipaddr', 1)">
+            <td>
+              <input id=craft_ipaddr type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('craft_ipaddr')">
+            <td>
+              <span id=craft_ipaddr_result>...</span>
 
-	</table>
-	<b>Radio Parameters:</b>
-	<table>
-	  <tr>
-	    <td align=center><b>Parameter
-	    <td align=center><b>Active Value
-	    <td align=center><b>Configure and Apply
-	    <td align=center><b>Status
+          <tr>
+            <td><b>Link IP Address
+            <td align=right><span id="platform/active_link_inet">...</span>
+            <td align=right>
+              <span id="platform/link_ipaddr">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('link_ipaddr', 1)">
+            <td>
+              <input id=link_ipaddr type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('link_ipaddr')">
+            <td>
+              <span id=link_ipaddr_result>...</span>
 
-	  <tr>
-	    <td><b>High Frequency
-	    <td align=right><span id="radio/hiTransceiver/pll/frequency">...</span>
-	    <td>
-	      <input id=freq_hi type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('freq_hi')">
-	    <td>
-	      <span id=freq_hi_result>...</span>
+          <tr>
+            <td><b>Peer IP Address
+            <td align=right>See Peer
+            <td align=right>
+              <span id="platform/peer_ipaddr">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('peer_ipaddr', 1)">
+            <td>
+              <input id=peer_ipaddr type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('peer_ipaddr')">
+            <td>
+              <span id=peer_ipaddr_result>...</span>
 
-	  <tr>
-	    <td><b>Low Frequency
-	    <td align=right><span id="radio/loTransceiver/pll/frequency">...</span>
-	    <td>
-	      <input id=freq_lo type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('freq_lo')">
-	    <td>
-	      <span id=freq_lo_result>...</span>
+          <tr>
+            <td><b>In-band Management VLAN
+            <td align=right><span id="platform/active_inband_vlan">...</span>
+            <td align=right>
+              <span id="platform/vlan_inband">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_inband', 1)">
+            <td>
+              <input id=vlan_inband type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('vlan_inband')">
+            <td>
+              <span id=vlan_inband_result>...</span>
 
-	  <tr>
-	    <td><b>High Frequency Mode
-	    <td align=right><span id="radio/hiTransceiver/mode">...</span>
-	    <td>
-	      <input id=mode_hi type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('mode_hi')">
-	    <td>
-	      <span id=mode_hi_result>...</span>
+          <tr>
+            <td><b>Out-of-band Management VLAN
+            <td align=right><span id="platform/active_ooband_vlan">...</span>
+            <td align=right>
+              <span id="platform/vlan_ooband">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_ooband', 1)">
+            <td>
+              <input id=vlan_ooband type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('vlan_ooband')">
+            <td>
+              <span id=vlan_ooband_result>...</span>
 
-	  <tr>
-	    <td><b>Transmit Power (dB x 100)
-	    <td align=right><span id="radio/tx/paPowerSet">...</span>
-	    <td>
-	      <input id=tx_powerlevel type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('tx_powerlevel')">
-	    <td>
-	      <span id=tx_powerlevel_result>...</span>
+          <tr>
+            <td><b>Link VLAN (to peer)
+            <td align=right><span id="platform/active_link_vlan">...</span>
+            <td align=right>
+              <span id="platform/vlan_link">...</span>
+              <input type=submit value="Apply Now" onclick="CraftUI.config('vlan_peer', 1)">
+            <td>
+              <input id=vlan_peer type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('vlan_peer')">
+            <td>
+              <span id=vlan_peer_result>...</span>
 
-	  <tr>
-	    <td><b>Transmit VGA Gain
-	    <td align=right><span id="radio/tx/vgaGain">...</span>
-	    <td>
-	      <input id=tx_gain type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('tx_gain')">
-	    <td>
-	      <span id=tx_gain_result>...</span>
+        </table>
+      </div>
+    </div>
 
-	  <tr>
-	    <td><b>Receiver AGC Digital Gain Index
-	    <td align=right><span id="radio/rx/agcDigitalGainIndex">...</span>
-	    <td>
-	      <input id=rx_gainindex type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('rx_gainindex')">
-	    <td>
-	      <span id=rx_gainindex_result>...</span>
+    <div class="tab">
+      <input type="radio" id="tab-4" name="tab-group-1">
+      <label for="tab-4">Radio</label>
+      <div class="content">
+        <b>Radio Parameters:</b>
+        <table>
+          <tr>
+            <td align=center><b>Parameter
+            <td align=center><b>Active Value
+            <td align=center><b>Configure and Apply
+            <td align=center><b>Status
 
-	  <tr>
-	    <td><b>PA & LNA Enabled
-	    <td align=right><span id="radio/paLnaPowerEnabled">...</span>
-	    <td>
-	      <input id=palna_on type=text value="">
-	      <input type=submit value=Configure onclick="CraftUI.config('palna_on')">
-	    <td>
-	      <span id=palna_on_result>...</span>
+          <tr>
+            <td><b>High Frequency
+            <td align=right><span id="radio/hiTransceiver/pll/frequency">...</span>
+            <td>
+              <input id=freq_hi type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('freq_hi')">
+            <td>
+              <span id=freq_hi_result>...</span>
 
-	</table>
+          <tr>
+            <td><b>Low Frequency
+            <td align=right><span id="radio/loTransceiver/pll/frequency">...</span>
+            <td>
+              <input id=freq_lo type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('freq_lo')">
+            <td>
+              <span id=freq_lo_result>...</span>
+
+          <tr>
+            <td><b>High Frequency Mode
+            <td align=right><span id="radio/hiTransceiver/mode">...</span>
+            <td>
+              <input id=mode_hi type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('mode_hi')">
+            <td>
+              <span id=mode_hi_result>...</span>
+
+          <tr>
+            <td><b>Transmit Power (dB x 100)
+            <td align=right><span id="radio/tx/paPowerSet">...</span>
+            <td>
+              <input id=tx_powerlevel type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('tx_powerlevel')">
+            <td>
+              <span id=tx_powerlevel_result>...</span>
+
+          <tr>
+            <td><b>Transmit VGA Gain
+            <td align=right><span id="radio/tx/vgaGain">...</span>
+            <td>
+              <input id=tx_gain type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('tx_gain')">
+            <td>
+              <span id=tx_gain_result>...</span>
+
+          <tr>
+            <td><b>Receiver AGC Digital Gain Index
+            <td align=right><span id="radio/rx/agcDigitalGainIndex">...</span>
+            <td>
+              <input id=rx_gainindex type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('rx_gainindex')">
+            <td>
+              <span id=rx_gainindex_result>...</span>
+
+          <tr>
+            <td><b>PA & LNA Enabled
+            <td align=right><span id="radio/paLnaPowerEnabled">...</span>
+            <td>
+              <input id=palna_on type=text value="">
+              <input type=submit value=Configure onclick="CraftUI.config('palna_on')">
+            <td>
+              <span id=palna_on_result>...</span>
+
+        </table>
       </div>
     </div>
     <div class="tab">
-      <input type="radio" id="tab-2" name="tab-group-1">
-      <label for="tab-2">Debug</label>
+      <input type="radio" id="tab-5" name="tab-group-1">
+      <label for="tab-5">Debug</label>
       <div class="content">
         <b>refreshCount:</b><span class="values" id="platform/refreshCount">...</span><br>
         <b>unhandled xml:</b><span class="values" id="unhandled"></span>
diff --git a/craftui/www/static/craft.js b/craftui/www/static/craft.js
index f93df89..fe7d9bc 100644
--- a/craftui/www/static/craft.js
+++ b/craftui/www/static/craft.js
@@ -82,20 +82,28 @@
   xhr.send();
 };
 
-CraftUI.config = function(key, activate) {
+CraftUI.config = function(key, activate, is_password) {
   // POST as json
   var el = document.getElementById(key);
-  var value = el.value;
   var xhr = new XMLHttpRequest();
   var action = "Configured";
   xhr.open('post', 'content.json');
   xhr.setRequestHeader('Content-Type', 'application/json; charset=UTF-8');
   var data;
-  if (activate) {
+  if (is_password) {
+    var value_admin = btoa(document.getElementById(key + "_admin").value);
+    var value_new = btoa(document.getElementById(key + "_new").value);
+    var value_confirm = btoa(document.getElementById(key + "_confirm").value);
+    data = { config: [ { [key]: {
+          "admin": value_admin,
+          "new": value_new,
+          "confirm": value_confirm,
+        } } ] };
+  } else if (activate) {
     data = { config: [ { [key + "_activate"]: "true" } ] };
     action = "Applied";
   } else {
-    data = { config: [ { [key]: value } ] };
+    data = { config: [ { [key]: el.value } ] };
   }
   var txt = JSON.stringify(data);
   var resultid = key + "_result"