diff --git a/scripts/pi-hole/js/settings-api.js b/scripts/pi-hole/js/settings-api.js
index 9c05af204..88b3510e0 100644
--- a/scripts/pi-hole/js/settings-api.js
+++ b/scripts/pi-hole/js/settings-api.js
@@ -11,6 +11,7 @@ var apiSessionsTable = null;
 var ownSessionID = null;
 var deleted = 0;
 var TOTPdata = null;
+var apppwSet = false;
 
 function renderBool(data, type) {
   // Display and search content
@@ -267,6 +268,7 @@ function processWebServerConfig() {
     .done(function (data) {
       setConfigValues("webserver", "webserver", data.config.webserver);
       if (data.config.webserver.api.app_pwhash.value.length > 0) {
+        apppwSet = true;
         $("#existing_apppw_warning").show();
         $("#apppw_submit").text("Replace app password");
         $("#apppw_submit").removeClass("btn-success");
@@ -333,7 +335,25 @@ $("#modal-apppw").on("shown.bs.modal", function () {
 
 $("#apppw_submit").on("click", function () {
   // Enable app password
-  setAppPassword();
+  if (!apppwSet) {
+    return setAppPassword();
+  }
+
+  // Else: Show confirm dialog
+  $.confirm({
+    text: "Are you sure you want to replace your previous app password? You will need to re-login to continue using the web interface.",
+    title: "Confirmation required",
+    confirm: setAppPassword,
+    cancel: function () {
+      // nothing to do
+    },
+    confirmButton: "Yes, replace password",
+    cancelButton: "No, go back",
+    post: true,
+    confirmButtonClass: "btn-danger",
+    cancelButtonClass: "btn-success",
+    dialogClass: "modal-dialog",
+  });
 });
 
 $("#apppw_clear").on("click", function () {