diff --git a/app/Http/Controllers/AuthController.php b/app/Http/Controllers/AuthController.php
index 8728e602..407a4e7b 100644
--- a/app/Http/Controllers/AuthController.php
+++ b/app/Http/Controllers/AuthController.php
@@ -133,7 +133,7 @@ class AuthController extends Controller
         $user->nickname = $data[option('register_with_player_name') ? 'player_name' : 'nickname'];
         $user->score = option('user_initial_score');
         $user->avatar = 0;
-        $user->password = User::getEncryptedPwdFromEvent($data['password'], $user)
+        $user->password = $user->getEncryptedPwdFromEvent($data['password'])
             ?: app('cipher')->hash($data['password'], config('secure.salt'));
         $user->ip = get_client_ip();
         $user->permission = User::NORMAL;
diff --git a/app/Http/Controllers/SetupController.php b/app/Http/Controllers/SetupController.php
index d566812c..9555a6ab 100644
--- a/app/Http/Controllers/SetupController.php
+++ b/app/Http/Controllers/SetupController.php
@@ -170,8 +170,7 @@ class SetupController extends Controller
         $user->nickname = $data['nickname'];
         $user->score = option('user_initial_score');
         $user->avatar = 0;
-        $user->password = User::getEncryptedPwdFromEvent($data['password'], $user)
-            ?: app('cipher')->hash($data['password'], config('secure.salt'));
+        $user->password = app('cipher')->hash($data['password'], config('secure.salt'));
         $user->ip = get_client_ip();
         $user->permission = User::SUPER_ADMIN;
         $user->register_at = get_datetime_string();
diff --git a/app/Models/Concerns/HasPassword.php b/app/Models/Concerns/HasPassword.php
new file mode 100644
index 00000000..71fa8150
--- /dev/null
+++ b/app/Models/Concerns/HasPassword.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Models\Concerns;
+
+use Illuminate\Support\Arr;
+use App\Events\EncryptUserPassword;
+
+trait HasPassword
+{
+    public function verifyPassword($raw)
+    {
+        // Compare directly if any responses is returned by event dispatcher
+        if ($result = $this->getEncryptedPwdFromEvent($raw, $this)) {
+            return hash_equals($this->password, $result);     // @codeCoverageIgnore
+        }
+
+        return app('cipher')->verify($raw, $this->password, config('secure.salt'));
+    }
+
+    /**
+     * Try to get encrypted password from event dispatcher.
+     *
+     * @param  string $raw
+     * @param  User   $user
+     * @return mixed
+     */
+    public function getEncryptedPwdFromEvent($raw)
+    {
+        $responses = event(new EncryptUserPassword($raw, $this));
+        return Arr::get($responses, 0);
+    }
+
+    /**
+     * Change password of the user.
+     *
+     * @param  string $password New password that will be set.
+     * @return bool
+     */
+    public function changePassword($password)
+    {
+        $responses = event(new EncryptUserPassword($password, $this));
+        $this->password = Arr::get($responses, 0, app('cipher')->hash($password, config('secure.salt')));
+        return $this->save();
+    }
+}
diff --git a/app/Models/User.php b/app/Models/User.php
index f657f019..6dcc347a 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -2,9 +2,8 @@
 
 namespace App\Models;
 
-use Illuminate\Support\Arr;
 use Laravel\Passport\HasApiTokens;
-use App\Events\EncryptUserPassword;
+use App\Models\Concerns\HasPassword;
 use Tymon\JWTAuth\Contracts\JWTSubject;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Foundation\Auth\User as Authenticatable;
@@ -12,6 +11,7 @@ use Illuminate\Foundation\Auth\User as Authenticatable;
 class User extends Authenticatable implements JWTSubject
 {
     use Notifiable;
+    use HasPassword;
     use HasApiTokens;
 
     const BANNED = -1;
@@ -59,42 +59,6 @@ class User extends Authenticatable implements JWTSubject
         }
     }
 
-    public function verifyPassword($raw)
-    {
-        // Compare directly if any responses is returned by event dispatcher
-        if ($result = static::getEncryptedPwdFromEvent($raw, $this)) {
-            return hash_equals($this->password, $result);     // @codeCoverageIgnore
-        }
-
-        return app('cipher')->verify($raw, $this->password, config('secure.salt'));
-    }
-
-    /**
-     * Try to get encrypted password from event dispatcher.
-     *
-     * @param  string $raw
-     * @param  User   $user
-     * @return mixed
-     */
-    public static function getEncryptedPwdFromEvent($raw, User $user)
-    {
-        $responses = event(new EncryptUserPassword($raw, $user));
-        return Arr::get($responses, 0);
-    }
-
-    /**
-     * Change password of the user.
-     *
-     * @param  string $password New password that will be set.
-     * @return bool
-     */
-    public function changePassword($password)
-    {
-        $responses = event(new EncryptUserPassword($password, $this));
-        $this->password = Arr::get($responses, 0, app('cipher')->hash($password, config('secure.salt')));
-        return $this->save();
-    }
-
     public function delete()
     {
         Player::where('uid', $this->uid)->delete();