Who really supports /.well-known/change-password? A 40-domain measurement, and why 16 looks like 11

First-hand measurement of the /.well-known/change-password well-known URI across 40 major web services, 2026-08-24. One GET per domain, redirects followed, reproducible with curl.

11 work, 24 are absent, and 5 look like support without being it. A status-code-only survey of these same 40 domains would report 16. The gap is the point of the dataset: keepersecurity.com redirects to its own 404 page served with HTTP 200, titled "The page you requested doesn't exist."; protonmail.com redirects to security.txt, a different well-known URI; linkedin.com serves a reCAPTCHA challenge; twitch.tv serves its generic application shell.

Of the six password managers probed, only 1Password works. The well-known URI exists precisely so that a password manager can send a user to a site's change-password form, and five of the six that would consume it do not publish it themselves.

Limits, vantage point and method are documented in the README. Measured for PwdFortress.