diff --git a/core/modules/hal/hal.services.yml b/core/modules/hal/hal.services.yml
index 4e89841..74c0b93 100644
--- a/core/modules/hal/hal.services.yml
+++ b/core/modules/hal/hal.services.yml
@@ -22,6 +22,11 @@ services:
     arguments: ['@rest.link_manager', '@entity.manager', '@module_handler']
     tags:
       - { name: normalizer, priority: 10 }
+  serializer.normalizer.user.hal:
+    class: Drupal\hal\Normalizer\UserNormalizer
+    arguments: ['@rest.link_manager', '@entity.manager', '@module_handler']
+    tags:
+      - { name: normalizer, priority: 30 }
   serializer.encoder.hal:
     class: Drupal\hal\Encoder\JsonEncoder
     tags:
diff --git a/core/modules/hal/src/Normalizer/UserNormalizer.php b/core/modules/hal/src/Normalizer/UserNormalizer.php
new file mode 100644
index 0000000..f0ec165
--- /dev/null
+++ b/core/modules/hal/src/Normalizer/UserNormalizer.php
@@ -0,0 +1,79 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\hal\Normalizer\UserNormalizer.
+ */
+
+namespace Drupal\hal\Normalizer;
+
+use Drupal\hal\Normalizer\ContentEntityNormalizer;
+use Drupal\Component\Utility\NestedArray;
+use Drupal\Core\Entity\EntityManagerInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\rest\LinkManager\LinkManagerInterface;
+use Symfony\Component\Serializer\Exception\UnexpectedValueException;
+
+/**
+ * Converts the Drupal entity object structure to a HAL array structure.
+ */
+class UserNormalizer extends ContentEntityNormalizer {
+
+  /**
+   * The interface or class that this Normalizer supports.
+   *
+   * @var string
+   */
+  protected $supportedInterfaceOrClass = 'Drupal\user\UserInterface';
+
+  /**
+   * The hypermedia link manager.
+   *
+   * @var \Drupal\rest\LinkManager\LinkManagerInterface
+   */
+  protected $linkManager;
+
+  /**
+   * The entity manager.
+   *
+   * @var \Drupal\Core\Entity\EntityManagerInterface
+   */
+  protected $entityManager;
+
+  /**
+   * The module handler.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * {@inheritdoc}
+   */
+  public function __construct(LinkManagerInterface $link_manager, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler) {
+    parent::__construct($link_manager, $entity_manager, $module_handler);
+
+    $this->excludedFields = array_flip($this->excludedFields());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function normalize($entity, $format = NULL, array $context = array()) {
+    // Make sure the password field is never normalized. Regardless of access.
+    // If this is needed, the user object can be extended or this normalizer
+    // can be overridden/replaced or have another normalizer with a higher
+    // priority normalize it first.
+    $normalized = parent::normalize($entity, $format, $context);
+    return array_diff_key($normalized, $this->excludedFields);
+  }
+
+  /**
+   * Returns a list of excluded field keys.
+   *
+   * @return array
+   */
+  protected function excludedFields() {
+    return ['pass'];
+  }
+}
diff --git a/core/modules/serialization/src/Tests/EntitySerializationTest.php b/core/modules/serialization/src/Tests/EntitySerializationTest.php
index 849b271..08109bc 100644
--- a/core/modules/serialization/src/Tests/EntitySerializationTest.php
+++ b/core/modules/serialization/src/Tests/EntitySerializationTest.php
@@ -9,6 +9,7 @@
 
 use Drupal\Core\Language\LanguageInterface;
 use Drupal\Component\Utility\String;
+use Drupal\user\Entity\User;
 
 /**
  * Tests that entities can be serialized to supported core formats.
@@ -48,6 +49,8 @@ class EntitySerializationTest extends NormalizerTestBase {
   protected function setUp() {
     parent::setUp();
 
+    // User create needs sequence table.
+    $this->installSchema('system', array('sequences'));
     // Create a test entity to serialize.
     $this->values = array(
       'name' => $this->randomMachineName(),
@@ -105,6 +108,16 @@ public function testNormalize() {
       $this->assertEqual($expected[$fieldName], $normalized[$fieldName], "ComplexDataNormalizer produces expected array for $fieldName.");
     }
     $this->assertEqual(array_diff_key($normalized, $expected), array(), 'No unexpected data is added to the normalized array.');
+
+    // Test password isn't available.
+    $account = User::create([
+      'name' => 'foo',
+      'mail' => 'foo@example.com',
+      'pass' => '123456',
+    ]);
+    $account->save();
+    $normalized = $this->serializer->normalize($account);
+    $this->assertFalse(isset($normalized['pass']));
   }
 
   /**