diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index e373147c9a3..bede00561a6 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -4456,6 +4456,7 @@ function hash_internal_user_password($password, $fasthash = false) {
  *
  * Updating the password will modify the $user object and the database
  * record to use the current hashing algorithm.
+ * It will remove Web Services user tokens too.
  *
  * @param stdClass $user User object (password property may be updated).
  * @param string $password Plain text password.
@@ -4505,6 +4506,10 @@ function update_internal_user_password($user, $password, $fasthash = false) {
         // Trigger event.
         $user = $DB->get_record('user', array('id' => $user->id));
         \core\event\user_password_updated::create_from_user($user)->trigger();
+
+        // Remove WS user tokens.
+        require_once($CFG->dirroot.'/webservice/lib.php');
+        webservice::delete_user_ws_tokens($user->id);
     }
 
     return true;
diff --git a/webservice/lib.php b/webservice/lib.php
index fc9c1780a2b..776b1e75ca4 100644
--- a/webservice/lib.php
+++ b/webservice/lib.php
@@ -421,6 +421,16 @@ class webservice {
         $DB->delete_records('external_tokens', array('id'=>$tokenid));
     }
 
+    /**
+     * Delete all the tokens belonging to a user.
+     *
+     * @param int $userid the user id whose tokens must be deleted
+     */
+    public static function delete_user_ws_tokens($userid) {
+        global $DB;
+        $DB->delete_records('external_tokens', array('userid' => $userid));
+    }
+
     /**
      * Delete a service
      * Also delete function references and authorised user references.