diff --git a/scopes/api/auth/user.py b/scopes/api/auth/user.py
index c57d0d4..7e03839 100644
--- a/scopes/api/auth/user.py
+++ b/scopes/api/auth/user.py
@@ -25,6 +25,10 @@ class User(BaseModel):
 class UserIn(User):
     password: str | None = None
 
+    def hashPassword(self) -> str | None:
+        pw = self.password
+        return pw and hashPassword(pw) or None
+
 # password handling, authentication
 
 pw_hash = PasswordHash.recommended()
diff --git a/scopes/shape.py b/scopes/shape.py
index 884d930..23cbb06 100644
--- a/scopes/shape.py
+++ b/scopes/shape.py
@@ -56,13 +56,13 @@ class Record:
         return cls(**self.asDict(flatten=True))
 
     @staticmethod
-    def prepareData(data):
+    def prepareData(data, obj):
         return data
 
     @classmethod
     def fromObject(cls, obj):
         inp = obj.model_dump()
         headValues = [inp.pop(hf) for hf in cls.headFields]
-        data = cls.prepareData(inp)
+        data = cls.prepareData(inp, obj)
         return cls(*headValues, data=data)
 
diff --git a/scopes/storage/tracking.py b/scopes/storage/tracking.py
index 86df089..6bc7132 100644
--- a/scopes/storage/tracking.py
+++ b/scopes/storage/tracking.py
@@ -34,7 +34,7 @@ class Record(shape.Record):
         return base | super().asDict()
 
     @staticmethod
-    def prepareData(data):
+    def prepareData(data, obj):
         data.pop('uid', None)
         data.pop('timeStamp', None)
         return data
diff --git a/scopes/storage/user.py b/scopes/storage/user.py
index 9e22d90..f0c655e 100644
--- a/scopes/storage/user.py
+++ b/scopes/storage/user.py
@@ -9,12 +9,10 @@ class User(concept.Concept):
     prefix = 'user'
 
     @staticmethod
-    def prepareData(data):
-        from scopes.api.auth.user import hashPassword
-        data = concept.Concept.prepareData(data)
+    def prepareData(data, obj):
+        data = concept.Concept.prepareData(data, obj)
         pw = data.pop('password', None)
-        if pw:
-            data['pw_hash'] = hashPassword(pw)
+        data['pw_hash'] = obj.hashPassword()
         return data