diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4368dbb..6e3834c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,3 +30,6 @@
 
 * v2.5.0 -- 20210512
   - add `attached_policies` to enable adding policies for an IAM account (generally, just services)
+
+* v2.5.1 -- 20210526
+  - change computing of output of user_password
diff --git a/main.tf b/main.tf
index f0e14eb..4033ba2 100644
--- a/main.tf
+++ b/main.tf
@@ -47,6 +47,7 @@ locals {
   email_address     = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0]
   pgp_key_exists    = var.pgp_key != "" ? 1 : 0
   generate_password = var.generate_password ? local.pgp_key_exists : 0
+  user_password     = local.generate_password ? element(concat(aws_iam_user_login_profile.user[*].encrypted_password, tolist([])), 0) : ""
   ap1               = var.service_account ? var.attached_policies : []
   ap2 = [for arn in local.ap1 : {
     "policy" = arn
diff --git a/outputs.tf b/outputs.tf
index 5bb4080..839a91c 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -10,5 +10,6 @@ output "user_arn" {
 
 output "user_password" {
   description = "User Password"
-  value       = var.generate_password ? element(aws_iam_user_login_profile.user[*].encrypted_password, 0) : ""
+  #  value       = var.generate_password ? element(aws_iam_user_login_profile.user[*].encrypted_password, 0) : ""
+  value = local.user_password
 }
diff --git a/version.tf b/version.tf
index fca0743..5624ad5 100644
--- a/version.tf
+++ b/version.tf
@@ -1,3 +1,3 @@
 locals {
-  _module_version = "2.5.0"
+  _module_version = "2.5.1"
 }