diff --git a/lib/actions/user-actions.js b/lib/actions/user-actions.js
--- a/lib/actions/user-actions.js
+++ b/lib/actions/user-actions.js
@@ -257,7 +257,10 @@
       if (!identityClient) {
         throw new Error('Identity service client is not initialized');
       }
-      return await identityClient.deleteUser();
+      if (!identityClient.deleteWalletUser) {
+        throw new Error('Delete wallet user method unimplemented');
+      }
+      return await identityClient.deleteWalletUser();
     })();
     const [keyserverResult] = await Promise.all([
       callKeyserverDeleteAccount({
diff --git a/lib/types/identity-service-types.js b/lib/types/identity-service-types.js
--- a/lib/types/identity-service-types.js
+++ b/lib/types/identity-service-types.js
@@ -116,7 +116,9 @@
   });
 
 export interface IdentityServiceClient {
-  +deleteUser: () => Promise<void>;
+  // Only a primary device can initiate account deletion, and web cannot be a
+  // primary device
+  +deleteWalletUser?: () => Promise<void>;
   +logOut: () => Promise<void>;
   +getKeyserverKeys: string => Promise<DeviceOlmOutboundKeys>;
   +registerPasswordUser?: (
diff --git a/native/cpp/CommonCpp/NativeModules/CommRustModule.h b/native/cpp/CommonCpp/NativeModules/CommRustModule.h
--- a/native/cpp/CommonCpp/NativeModules/CommRustModule.h
+++ b/native/cpp/CommonCpp/NativeModules/CommRustModule.h
@@ -64,7 +64,7 @@
       jsi::String deviceID,
       jsi::String accessToken,
       jsi::String password) override;
-  virtual jsi::Value deleteUser(
+  virtual jsi::Value deleteWalletUser(
       jsi::Runtime &rt,
       jsi::String userID,
       jsi::String deviceID,
diff --git a/native/cpp/CommonCpp/NativeModules/CommRustModule.cpp b/native/cpp/CommonCpp/NativeModules/CommRustModule.cpp
--- a/native/cpp/CommonCpp/NativeModules/CommRustModule.cpp
+++ b/native/cpp/CommonCpp/NativeModules/CommRustModule.cpp
@@ -270,7 +270,7 @@
       });
 }
 
-jsi::Value CommRustModule::deleteUser(
+jsi::Value CommRustModule::deleteWalletUser(
     jsi::Runtime &rt,
     jsi::String userID,
     jsi::String deviceID,
@@ -285,7 +285,7 @@
         try {
           auto currentID = RustPromiseManager::instance.addPromise(
               {promise, this->jsInvoker_, innerRt});
-          identityDeleteUser(
+          identityDeleteWalletUser(
               userIDRust, deviceIDRust, accessTokenRust, currentID);
         } catch (const std::exception &e) {
           error = e.what();
diff --git a/native/cpp/CommonCpp/_generated/rustJSI-generated.cpp b/native/cpp/CommonCpp/_generated/rustJSI-generated.cpp
--- a/native/cpp/CommonCpp/_generated/rustJSI-generated.cpp
+++ b/native/cpp/CommonCpp/_generated/rustJSI-generated.cpp
@@ -30,8 +30,8 @@
 static jsi::Value __hostFunction_CommRustModuleSchemaCxxSpecJSI_updatePassword(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
   return static_cast<CommRustModuleSchemaCxxSpecJSI *>(&turboModule)->updatePassword(rt, args[0].asString(rt), args[1].asString(rt), args[2].asString(rt), args[3].asString(rt));
 }
-static jsi::Value __hostFunction_CommRustModuleSchemaCxxSpecJSI_deleteUser(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
-  return static_cast<CommRustModuleSchemaCxxSpecJSI *>(&turboModule)->deleteUser(rt, args[0].asString(rt), args[1].asString(rt), args[2].asString(rt));
+static jsi::Value __hostFunction_CommRustModuleSchemaCxxSpecJSI_deleteWalletUser(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
+  return static_cast<CommRustModuleSchemaCxxSpecJSI *>(&turboModule)->deleteWalletUser(rt, args[0].asString(rt), args[1].asString(rt), args[2].asString(rt));
 }
 static jsi::Value __hostFunction_CommRustModuleSchemaCxxSpecJSI_logOut(jsi::Runtime &rt, TurboModule &turboModule, const jsi::Value* args, size_t count) {
   return static_cast<CommRustModuleSchemaCxxSpecJSI *>(&turboModule)->logOut(rt, args[0].asString(rt), args[1].asString(rt), args[2].asString(rt));
@@ -87,7 +87,7 @@
   methodMap_["registerWalletUser"] = MethodMetadata {11, __hostFunction_CommRustModuleSchemaCxxSpecJSI_registerWalletUser};
   methodMap_["logInWalletUser"] = MethodMetadata {8, __hostFunction_CommRustModuleSchemaCxxSpecJSI_logInWalletUser};
   methodMap_["updatePassword"] = MethodMetadata {4, __hostFunction_CommRustModuleSchemaCxxSpecJSI_updatePassword};
-  methodMap_["deleteUser"] = MethodMetadata {3, __hostFunction_CommRustModuleSchemaCxxSpecJSI_deleteUser};
+  methodMap_["deleteWalletUser"] = MethodMetadata {3, __hostFunction_CommRustModuleSchemaCxxSpecJSI_deleteWalletUser};
   methodMap_["logOut"] = MethodMetadata {3, __hostFunction_CommRustModuleSchemaCxxSpecJSI_logOut};
   methodMap_["getOutboundKeysForUser"] = MethodMetadata {4, __hostFunction_CommRustModuleSchemaCxxSpecJSI_getOutboundKeysForUser};
   methodMap_["getInboundKeysForUser"] = MethodMetadata {4, __hostFunction_CommRustModuleSchemaCxxSpecJSI_getInboundKeysForUser};
diff --git a/native/cpp/CommonCpp/_generated/rustJSI.h b/native/cpp/CommonCpp/_generated/rustJSI.h
--- a/native/cpp/CommonCpp/_generated/rustJSI.h
+++ b/native/cpp/CommonCpp/_generated/rustJSI.h
@@ -26,7 +26,7 @@
   virtual jsi::Value registerWalletUser(jsi::Runtime &rt, jsi::String siweMessage, jsi::String siweSignature, jsi::String keyPayload, jsi::String keyPayloadSignature, jsi::String contentPrekey, jsi::String contentPrekeySignature, jsi::String notifPrekey, jsi::String notifPrekeySignature, jsi::Array contentOneTimeKeys, jsi::Array notifOneTimeKeys, jsi::String farcasterID) = 0;
   virtual jsi::Value logInWalletUser(jsi::Runtime &rt, jsi::String siweMessage, jsi::String siweSignature, jsi::String keyPayload, jsi::String keyPayloadSignature, jsi::String contentPrekey, jsi::String contentPrekeySignature, jsi::String notifPrekey, jsi::String notifPrekeySignature) = 0;
   virtual jsi::Value updatePassword(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken, jsi::String password) = 0;
-  virtual jsi::Value deleteUser(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) = 0;
+  virtual jsi::Value deleteWalletUser(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) = 0;
   virtual jsi::Value logOut(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) = 0;
   virtual jsi::Value getOutboundKeysForUser(jsi::Runtime &rt, jsi::String authUserID, jsi::String authDeviceID, jsi::String authAccessToken, jsi::String userID) = 0;
   virtual jsi::Value getInboundKeysForUser(jsi::Runtime &rt, jsi::String authUserID, jsi::String authDeviceID, jsi::String authAccessToken, jsi::String userID) = 0;
@@ -111,13 +111,13 @@
       return bridging::callFromJs<jsi::Value>(
           rt, &T::updatePassword, jsInvoker_, instance_, std::move(userID), std::move(deviceID), std::move(accessToken), std::move(password));
     }
-    jsi::Value deleteUser(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) override {
+    jsi::Value deleteWalletUser(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) override {
       static_assert(
-          bridging::getParameterCount(&T::deleteUser) == 4,
-          "Expected deleteUser(...) to have 4 parameters");
+          bridging::getParameterCount(&T::deleteWalletUser) == 4,
+          "Expected deleteWalletUser(...) to have 4 parameters");
 
       return bridging::callFromJs<jsi::Value>(
-          rt, &T::deleteUser, jsInvoker_, instance_, std::move(userID), std::move(deviceID), std::move(accessToken));
+          rt, &T::deleteWalletUser, jsInvoker_, instance_, std::move(userID), std::move(deviceID), std::move(accessToken));
     }
     jsi::Value logOut(jsi::Runtime &rt, jsi::String userID, jsi::String deviceID, jsi::String accessToken) override {
       static_assert(
diff --git a/native/identity-service/identity-service-context-provider.react.js b/native/identity-service/identity-service-context-provider.react.js
--- a/native/identity-service/identity-service-context-provider.react.js
+++ b/native/identity-service/identity-service-context-provider.react.js
@@ -77,13 +77,13 @@
 
   const client = React.useMemo<IdentityServiceClient>(
     () => ({
-      deleteUser: async () => {
+      deleteWalletUser: async () => {
         const {
           deviceID,
           userID,
           accessToken: token,
         } = await getAuthMetadata();
-        return commRustModule.deleteUser(userID, deviceID, token);
+        return commRustModule.deleteWalletUser(userID, deviceID, token);
       },
       logOut: async () => {
         const {
diff --git a/native/native_rust_library/src/identity/account_actions.rs b/native/native_rust_library/src/identity/account_actions.rs
--- a/native/native_rust_library/src/identity/account_actions.rs
+++ b/native/native_rust_library/src/identity/account_actions.rs
@@ -31,7 +31,7 @@
     });
   }
 
-  pub fn delete_user(
+  pub fn delete_wallet_user(
     user_id: String,
     device_id: String,
     access_token: String,
@@ -43,7 +43,7 @@
         user_id,
         device_id,
       };
-      let result = delete_user_helper(auth_info).await;
+      let result = delete_wallet_user_helper(auth_info).await;
       handle_void_result_as_callback(result, promise_id);
     });
   }
@@ -118,7 +118,7 @@
   Ok(())
 }
 
-async fn delete_user_helper(auth_info: AuthInfo) -> Result<(), Error> {
+async fn delete_wallet_user_helper(auth_info: AuthInfo) -> Result<(), Error> {
   let mut identity_client = get_auth_client(
     IDENTITY_SOCKET_ADDR,
     auth_info.user_id,
@@ -128,7 +128,7 @@
     DEVICE_TYPE.as_str_name().to_lowercase(),
   )
   .await?;
-  identity_client.delete_user(Empty {}).await?;
+  identity_client.delete_wallet_user(Empty {}).await?;
 
   Ok(())
 }
diff --git a/native/native_rust_library/src/lib.rs b/native/native_rust_library/src/lib.rs
--- a/native/native_rust_library/src/lib.rs
+++ b/native/native_rust_library/src/lib.rs
@@ -113,8 +113,8 @@
       promise_id: u32,
     );
 
-    #[cxx_name = "identityDeleteUser"]
-    fn delete_user(
+    #[cxx_name = "identityDeleteWalletUser"]
+    fn delete_wallet_user(
       user_id: String,
       device_id: String,
       access_token: String,
diff --git a/native/schema/CommRustModuleSchema.js b/native/schema/CommRustModuleSchema.js
--- a/native/schema/CommRustModuleSchema.js
+++ b/native/schema/CommRustModuleSchema.js
@@ -59,7 +59,7 @@
     accessToken: string,
     password: string,
   ) => Promise<void>;
-  +deleteUser: (
+  +deleteWalletUser: (
     userID: string,
     deviceID: string,
     accessToken: string,
diff --git a/services/identity/src/client_service.rs b/services/identity/src/client_service.rs
--- a/services/identity/src/client_service.rs
+++ b/services/identity/src/client_service.rs
@@ -18,6 +18,7 @@
   DBDeviceTypeInt, DatabaseClient, DeviceType, KeyPayload,
 };
 use crate::error::{DeviceListError, Error as DBError};
+use crate::grpc_services::authenticated::DeletePasswordUserInfo;
 use crate::grpc_services::protos::unauth::{
   find_user_id_request, AddReservedUsernamesRequest, AuthResponse, Empty,
   ExistingDeviceLoginRequest, FindUserIdRequest, FindUserIdResponse,
@@ -53,6 +54,7 @@
   Registration(Box<UserRegistrationInfo>),
   Login(Box<UserLoginInfo>),
   Update(UpdateState),
+  PasswordUserDeletion(Box<DeletePasswordUserInfo>),
 }
 
 #[derive(Clone, Serialize, Deserialize)]
@@ -301,7 +303,7 @@
           .map_err(handle_db_error)?;
 
         if username_in_reserved_usernames_table {
-          return Err(tonic::Status::failed_precondition(
+          return Err(tonic::Status::permission_denied(
             "need keyserver message to claim username",
           ));
         }
@@ -454,7 +456,7 @@
         .map_err(handle_db_error)?;
 
       if username_in_reserved_usernames_table {
-        return Err(tonic::Status::failed_precondition(
+        return Err(tonic::Status::permission_denied(
           "need keyserver message to claim username",
         ));
       }
diff --git a/services/identity/src/database.rs b/services/identity/src/database.rs
--- a/services/identity/src/database.rs
+++ b/services/identity/src/database.rs
@@ -824,7 +824,22 @@
     }
   }
 
-  pub async fn get_item_from_users_table(
+  pub async fn get_username_and_password_file(
+    &self,
+    user_id: &str,
+  ) -> Result<Option<(String, Vec<u8>)>, Error> {
+    let Some(mut user) = self.get_item_from_users_table(user_id).await?.item
+    else {
+      return Ok(None);
+    };
+    let username = user.take_attr(USERS_TABLE_USERNAME_ATTRIBUTE)?;
+    let password_file = parse_registration_data_attribute(
+      user.remove(USERS_TABLE_REGISTRATION_ATTRIBUTE),
+    )?;
+    Ok(Some((username, password_file)))
+  }
+
+  async fn get_item_from_users_table(
     &self,
     user_id: &str,
   ) -> Result<GetItemOutput, Error> {
diff --git a/services/identity/src/grpc_services/authenticated.rs b/services/identity/src/grpc_services/authenticated.rs
--- a/services/identity/src/grpc_services/authenticated.rs
+++ b/services/identity/src/grpc_services/authenticated.rs
@@ -15,18 +15,16 @@
 use tracing::{debug, error, warn};
 
 use super::protos::auth::{
-  identity_client_service_server::IdentityClientService, GetDeviceListRequest,
-  GetDeviceListResponse, InboundKeyInfo, InboundKeysForUserRequest,
-  InboundKeysForUserResponse, KeyserverKeysResponse,
-  LinkFarcasterAccountRequest, OutboundKeyInfo, OutboundKeysForUserRequest,
-  OutboundKeysForUserResponse, RefreshUserPrekeysRequest,
+  identity_client_service_server::IdentityClientService,
+  DeletePasswordUserFinishRequest, DeletePasswordUserStartRequest,
+  DeletePasswordUserStartResponse, GetDeviceListRequest, GetDeviceListResponse,
+  InboundKeyInfo, InboundKeysForUserRequest, InboundKeysForUserResponse,
+  KeyserverKeysResponse, LinkFarcasterAccountRequest, OutboundKeyInfo,
+  OutboundKeysForUserRequest, OutboundKeysForUserResponse,
+  PeersDeviceListsRequest, PeersDeviceListsResponse, RefreshUserPrekeysRequest,
   UpdateDeviceListRequest, UpdateUserPasswordFinishRequest,
   UpdateUserPasswordStartRequest, UpdateUserPasswordStartResponse,
-  UploadOneTimeKeysRequest,
-};
-use super::protos::auth::{
-  PeersDeviceListsRequest, PeersDeviceListsResponse, UserIdentityRequest,
-  UserIdentityResponse,
+  UploadOneTimeKeysRequest, UserIdentityRequest, UserIdentityResponse,
 };
 use super::protos::unauth::Empty;
 
@@ -319,12 +317,104 @@
     Ok(Response::new(response))
   }
 
-  async fn delete_user(
+  async fn delete_wallet_user(
     &self,
     request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let (user_id, _) = get_user_and_device_id(&request)?;
 
+    debug!("Attempting to delete wallet user: {}", user_id);
+
+    let maybe_username_and_password_file = self
+      .db_client
+      .get_username_and_password_file(&user_id)
+      .await
+      .map_err(handle_db_error)?;
+
+    if maybe_username_and_password_file.is_some() {
+      return Err(tonic::Status::permission_denied("password user"));
+    }
+
+    self
+      .db_client
+      .delete_user(user_id)
+      .await
+      .map_err(handle_db_error)?;
+
+    let response = Empty {};
+    Ok(Response::new(response))
+  }
+
+  async fn delete_password_user_start(
+    &self,
+    request: tonic::Request<DeletePasswordUserStartRequest>,
+  ) -> Result<tonic::Response<DeletePasswordUserStartResponse>, tonic::Status>
+  {
+    let (user_id, _) = get_user_and_device_id(&request)?;
+    let message = request.into_inner();
+
+    debug!("Attempting to start deleting password user: {}", user_id);
+    let maybe_username_and_password_file = self
+      .db_client
+      .get_username_and_password_file(&user_id)
+      .await
+      .map_err(handle_db_error)?;
+
+    let Some((username, password_file_bytes)) =
+      maybe_username_and_password_file
+    else {
+      return Err(tonic::Status::not_found("user not found"));
+    };
+
+    let mut server_login = comm_opaque2::server::Login::new();
+    let server_response = server_login
+      .start(
+        &CONFIG.server_setup,
+        &password_file_bytes,
+        &message.opaque_login_request,
+        username.as_bytes(),
+      )
+      .map_err(protocol_error_to_grpc_status)?;
+
+    let delete_state = construct_delete_password_user_info(server_login);
+
+    let session_id = self
+      .db_client
+      .insert_workflow(WorkflowInProgress::PasswordUserDeletion(Box::new(
+        delete_state,
+      )))
+      .await
+      .map_err(handle_db_error)?;
+
+    let response = Response::new(DeletePasswordUserStartResponse {
+      session_id,
+      opaque_login_response: server_response,
+    });
+    Ok(response)
+  }
+
+  async fn delete_password_user_finish(
+    &self,
+    request: tonic::Request<DeletePasswordUserFinishRequest>,
+  ) -> Result<tonic::Response<Empty>, tonic::Status> {
+    let (user_id, _) = get_user_and_device_id(&request)?;
+    let message = request.into_inner();
+
+    debug!("Attempting to finish deleting password user: {}", user_id);
+    let Some(WorkflowInProgress::PasswordUserDeletion(state)) = self
+      .db_client
+      .get_workflow(message.session_id)
+      .await
+      .map_err(handle_db_error)?
+    else {
+      return Err(tonic::Status::not_found("session not found"));
+    };
+
+    let mut server_login = state.opaque_server_login;
+    server_login
+      .finish(&message.opaque_login_upload)
+      .map_err(protocol_error_to_grpc_status)?;
+
     self
       .db_client
       .delete_user(user_id)
@@ -597,6 +687,19 @@
   }
 }
 
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
+pub struct DeletePasswordUserInfo {
+  pub opaque_server_login: comm_opaque2::server::Login,
+}
+
+fn construct_delete_password_user_info(
+  opaque_server_login: comm_opaque2::server::Login,
+) -> DeletePasswordUserInfo {
+  DeletePasswordUserInfo {
+    opaque_server_login,
+  }
+}
+
 #[cfg(test)]
 mod tests {
   use super::*;
diff --git a/shared/protos/identity_auth.proto b/shared/protos/identity_auth.proto
--- a/shared/protos/identity_auth.proto
+++ b/shared/protos/identity_auth.proto
@@ -51,7 +51,11 @@
   // Called by user to log out (clears device's keys and access token)
   rpc LogOutUser(identity.unauth.Empty) returns (identity.unauth.Empty) {}
   // Called by a user to delete their own account
-  rpc DeleteUser(identity.unauth.Empty) returns (identity.unauth.Empty) {}
+  rpc DeletePasswordUserStart(DeletePasswordUserStartRequest) returns
+    (DeletePasswordUserStartResponse) {}
+  rpc DeletePasswordUserFinish(DeletePasswordUserFinishRequest) returns
+    (identity.unauth.Empty) {}
+  rpc DeleteWalletUser(identity.unauth.Empty) returns (identity.unauth.Empty) {}
 
   /* Device list actions */
 
@@ -180,6 +184,27 @@
   bytes opaque_registration_response = 2;
 }
 
+// DeletePasswordUser
+
+// First user must log in
+message DeletePasswordUserStartRequest {
+  // Message sent to initiate PAKE login
+  bytes opaque_login_request = 1;
+}
+
+// If login is successful, the user's account will be deleted
+message DeletePasswordUserFinishRequest {
+  // Identifier used to correlate requests in the same workflow
+  string session_id = 1;
+  bytes opaque_login_upload = 2;
+}
+
+message DeletePasswordUserStartResponse {
+  // Identifier used to correlate requests in the same workflow
+  string session_id = 1;
+  bytes opaque_login_response = 2;
+}
+
 // GetDeviceListForUser
 
 message GetDeviceListRequest {
diff --git a/web/grpc/identity-service-client-wrapper.js b/web/grpc/identity-service-client-wrapper.js
--- a/web/grpc/identity-service-client-wrapper.js
+++ b/web/grpc/identity-service-client-wrapper.js
@@ -130,13 +130,6 @@
     );
   }
 
-  deleteUser: () => Promise<void> = async () => {
-    if (!this.authClient) {
-      throw new Error('Identity service client is not initialized');
-    }
-    await this.authClient.deleteUser(new Empty());
-  };
-
   logOut: () => Promise<void> = async () => {
     if (!this.authClient) {
       throw new Error('Identity service client is not initialized');
diff --git a/web/grpc/identity-service-context-provider.react.js b/web/grpc/identity-service-context-provider.react.js
--- a/web/grpc/identity-service-context-provider.react.js
+++ b/web/grpc/identity-service-context-provider.react.js
@@ -117,7 +117,7 @@
 
   const client = React.useMemo<IdentityServiceClient>(() => {
     return {
-      deleteUser: proxyMethodToWorker('deleteUser'),
+      deleteWalletUser: proxyMethodToWorker('deleteWalletUser'),
       logOut: proxyMethodToWorker('logOut'),
       getKeyserverKeys: proxyMethodToWorker('getKeyserverKeys'),
       getOutboundKeysForUser: proxyMethodToWorker('getOutboundKeysForUser'),
diff --git a/web/protobufs/identity-auth-client.cjs b/web/protobufs/identity-auth-client.cjs
--- a/web/protobufs/identity-auth-client.cjs
+++ b/web/protobufs/identity-auth-client.cjs
@@ -566,14 +566,136 @@
 };
 
 
+/**
+ * @const
+ * @type {!grpc.web.MethodDescriptor<
+ *   !proto.identity.auth.DeletePasswordUserStartRequest,
+ *   !proto.identity.auth.DeletePasswordUserStartResponse>}
+ */
+const methodDescriptor_IdentityClientService_DeletePasswordUserStart = new grpc.web.MethodDescriptor(
+  '/identity.auth.IdentityClientService/DeletePasswordUserStart',
+  grpc.web.MethodType.UNARY,
+  proto.identity.auth.DeletePasswordUserStartRequest,
+  proto.identity.auth.DeletePasswordUserStartResponse,
+  /**
+   * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request
+   * @return {!Uint8Array}
+   */
+  function(request) {
+    return request.serializeBinary();
+  },
+  proto.identity.auth.DeletePasswordUserStartResponse.deserializeBinary
+);
+
+
+/**
+ * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request The
+ *     request proto
+ * @param {?Object<string, string>} metadata User defined
+ *     call metadata
+ * @param {function(?grpc.web.RpcError, ?proto.identity.auth.DeletePasswordUserStartResponse)}
+ *     callback The callback function(error, response)
+ * @return {!grpc.web.ClientReadableStream<!proto.identity.auth.DeletePasswordUserStartResponse>|undefined}
+ *     The XHR Node Readable Stream
+ */
+proto.identity.auth.IdentityClientServiceClient.prototype.deletePasswordUserStart =
+    function(request, metadata, callback) {
+  return this.client_.rpcCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/DeletePasswordUserStart',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_DeletePasswordUserStart,
+      callback);
+};
+
+
+/**
+ * @param {!proto.identity.auth.DeletePasswordUserStartRequest} request The
+ *     request proto
+ * @param {?Object<string, string>=} metadata User defined
+ *     call metadata
+ * @return {!Promise<!proto.identity.auth.DeletePasswordUserStartResponse>}
+ *     Promise that resolves to the response
+ */
+proto.identity.auth.IdentityClientServicePromiseClient.prototype.deletePasswordUserStart =
+    function(request, metadata) {
+  return this.client_.unaryCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/DeletePasswordUserStart',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_DeletePasswordUserStart);
+};
+
+
+/**
+ * @const
+ * @type {!grpc.web.MethodDescriptor<
+ *   !proto.identity.auth.DeletePasswordUserFinishRequest,
+ *   !proto.identity.unauth.Empty>}
+ */
+const methodDescriptor_IdentityClientService_DeletePasswordUserFinish = new grpc.web.MethodDescriptor(
+  '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
+  grpc.web.MethodType.UNARY,
+  proto.identity.auth.DeletePasswordUserFinishRequest,
+  identity_unauth_pb.Empty,
+  /**
+   * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request
+   * @return {!Uint8Array}
+   */
+  function(request) {
+    return request.serializeBinary();
+  },
+  identity_unauth_pb.Empty.deserializeBinary
+);
+
+
+/**
+ * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request The
+ *     request proto
+ * @param {?Object<string, string>} metadata User defined
+ *     call metadata
+ * @param {function(?grpc.web.RpcError, ?proto.identity.unauth.Empty)}
+ *     callback The callback function(error, response)
+ * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
+ *     The XHR Node Readable Stream
+ */
+proto.identity.auth.IdentityClientServiceClient.prototype.deletePasswordUserFinish =
+    function(request, metadata, callback) {
+  return this.client_.rpcCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_DeletePasswordUserFinish,
+      callback);
+};
+
+
+/**
+ * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} request The
+ *     request proto
+ * @param {?Object<string, string>=} metadata User defined
+ *     call metadata
+ * @return {!Promise<!proto.identity.unauth.Empty>}
+ *     Promise that resolves to the response
+ */
+proto.identity.auth.IdentityClientServicePromiseClient.prototype.deletePasswordUserFinish =
+    function(request, metadata) {
+  return this.client_.unaryCall(this.hostname_ +
+      '/identity.auth.IdentityClientService/DeletePasswordUserFinish',
+      request,
+      metadata || {},
+      methodDescriptor_IdentityClientService_DeletePasswordUserFinish);
+};
+
+
 /**
  * @const
  * @type {!grpc.web.MethodDescriptor<
  *   !proto.identity.unauth.Empty,
  *   !proto.identity.unauth.Empty>}
  */
-const methodDescriptor_IdentityClientService_DeleteUser = new grpc.web.MethodDescriptor(
-  '/identity.auth.IdentityClientService/DeleteUser',
+const methodDescriptor_IdentityClientService_DeleteWalletUser = new grpc.web.MethodDescriptor(
+  '/identity.auth.IdentityClientService/DeleteWalletUser',
   grpc.web.MethodType.UNARY,
   identity_unauth_pb.Empty,
   identity_unauth_pb.Empty,
@@ -598,13 +720,13 @@
  * @return {!grpc.web.ClientReadableStream<!proto.identity.unauth.Empty>|undefined}
  *     The XHR Node Readable Stream
  */
-proto.identity.auth.IdentityClientServiceClient.prototype.deleteUser =
+proto.identity.auth.IdentityClientServiceClient.prototype.deleteWalletUser =
     function(request, metadata, callback) {
   return this.client_.rpcCall(this.hostname_ +
-      '/identity.auth.IdentityClientService/DeleteUser',
+      '/identity.auth.IdentityClientService/DeleteWalletUser',
       request,
       metadata || {},
-      methodDescriptor_IdentityClientService_DeleteUser,
+      methodDescriptor_IdentityClientService_DeleteWalletUser,
       callback);
 };
 
@@ -617,13 +739,13 @@
  * @return {!Promise<!proto.identity.unauth.Empty>}
  *     Promise that resolves to the response
  */
-proto.identity.auth.IdentityClientServicePromiseClient.prototype.deleteUser =
+proto.identity.auth.IdentityClientServicePromiseClient.prototype.deleteWalletUser =
     function(request, metadata) {
   return this.client_.unaryCall(this.hostname_ +
-      '/identity.auth.IdentityClientService/DeleteUser',
+      '/identity.auth.IdentityClientService/DeleteWalletUser',
       request,
       metadata || {},
-      methodDescriptor_IdentityClientService_DeleteUser);
+      methodDescriptor_IdentityClientService_DeleteWalletUser);
 };
 
 
diff --git a/web/protobufs/identity-auth-client.cjs.flow b/web/protobufs/identity-auth-client.cjs.flow
--- a/web/protobufs/identity-auth-client.cjs.flow
+++ b/web/protobufs/identity-auth-client.cjs.flow
@@ -67,7 +67,21 @@
                response: identityStructs.Empty) => void
   ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
 
-  deleteUser(
+  deletePasswordUserStart(
+    request: identityAuthStructs.DeletePasswordUserStartRequest,
+    metadata: grpcWeb.Metadata | void,
+    callback: (err: grpcWeb.RpcError,
+               response: identityAuthStructs.DeletePasswordUserStartResponse) => void
+  ): grpcWeb.ClientReadableStream<identityAuthStructs.DeletePasswordUserStartResponse>;
+
+  deletePasswordUserFinish(
+    request: identityAuthStructs.DeletePasswordUserFinishRequest,
+    metadata: grpcWeb.Metadata | void,
+    callback: (err: grpcWeb.RpcError,
+               response: identityStructs.Empty) => void
+  ): grpcWeb.ClientReadableStream<identityStructs.Empty>;
+
+  deleteWalletUser(
     request: identityStructs.Empty,
     metadata: grpcWeb.Metadata | void,
     callback: (err: grpcWeb.RpcError,
@@ -162,7 +176,17 @@
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
 
-  deleteUser(
+  deletePasswordUserStart(
+    request: identityAuthStructs.DeletePasswordUserStartRequest,
+    metadata?: grpcWeb.Metadata
+  ): Promise<identityAuthStructs.DeletePasswordUserStartResponse>;
+
+  deletePasswordUserFinish(
+    request: identityAuthStructs.DeletePasswordUserFinishRequest,
+    metadata?: grpcWeb.Metadata
+  ): Promise<identityStructs.Empty>;
+
+  deleteWalletUser(
     request: identityStructs.Empty,
     metadata?: grpcWeb.Metadata
   ): Promise<identityStructs.Empty>;
diff --git a/web/protobufs/identity-auth-structs.cjs b/web/protobufs/identity-auth-structs.cjs
--- a/web/protobufs/identity-auth-structs.cjs
+++ b/web/protobufs/identity-auth-structs.cjs
@@ -24,6 +24,9 @@
 
 var identity_unauth_pb = require('./identity-unauth-structs.cjs');
 goog.object.extend(proto, identity_unauth_pb);
+goog.exportSymbol('proto.identity.auth.DeletePasswordUserFinishRequest', null, global);
+goog.exportSymbol('proto.identity.auth.DeletePasswordUserStartRequest', null, global);
+goog.exportSymbol('proto.identity.auth.DeletePasswordUserStartResponse', null, global);
 goog.exportSymbol('proto.identity.auth.EthereumIdentity', null, global);
 goog.exportSymbol('proto.identity.auth.GetDeviceListRequest', null, global);
 goog.exportSymbol('proto.identity.auth.GetDeviceListResponse', null, global);
@@ -340,6 +343,69 @@
    */
   proto.identity.auth.UpdateUserPasswordStartResponse.displayName = 'proto.identity.auth.UpdateUserPasswordStartResponse';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.identity.auth.DeletePasswordUserStartRequest = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.identity.auth.DeletePasswordUserStartRequest, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.identity.auth.DeletePasswordUserStartRequest.displayName = 'proto.identity.auth.DeletePasswordUserStartRequest';
+}
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.identity.auth.DeletePasswordUserFinishRequest, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.identity.auth.DeletePasswordUserFinishRequest.displayName = 'proto.identity.auth.DeletePasswordUserFinishRequest';
+}
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.identity.auth.DeletePasswordUserStartResponse = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.identity.auth.DeletePasswordUserStartResponse, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.identity.auth.DeletePasswordUserStartResponse.displayName = 'proto.identity.auth.DeletePasswordUserStartResponse';
+}
 /**
  * Generated by JsPbCodeGenerator.
  * @param {Array=} opt_data Optional initial data array, typically from a
@@ -3245,6 +3311,528 @@
 
 
 
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.toObject = function(opt_includeInstance) {
+  return proto.identity.auth.DeletePasswordUserStartRequest.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.identity.auth.DeletePasswordUserStartRequest} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    opaqueLoginRequest: msg.getOpaqueLoginRequest_asB64()
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.identity.auth.DeletePasswordUserStartRequest}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.identity.auth.DeletePasswordUserStartRequest;
+  return proto.identity.auth.DeletePasswordUserStartRequest.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.identity.auth.DeletePasswordUserStartRequest} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.identity.auth.DeletePasswordUserStartRequest}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setOpaqueLoginRequest(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.identity.auth.DeletePasswordUserStartRequest.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.identity.auth.DeletePasswordUserStartRequest} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getOpaqueLoginRequest_asU8();
+  if (f.length > 0) {
+    writer.writeBytes(
+      1,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional bytes opaque_login_request = 1;
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.getOpaqueLoginRequest = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * optional bytes opaque_login_request = 1;
+ * This is a type-conversion wrapper around `getOpaqueLoginRequest()`
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.getOpaqueLoginRequest_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getOpaqueLoginRequest()));
+};
+
+
+/**
+ * optional bytes opaque_login_request = 1;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getOpaqueLoginRequest()`
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.getOpaqueLoginRequest_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getOpaqueLoginRequest()));
+};
+
+
+/**
+ * @param {!(string|Uint8Array)} value
+ * @return {!proto.identity.auth.DeletePasswordUserStartRequest} returns this
+ */
+proto.identity.auth.DeletePasswordUserStartRequest.prototype.setOpaqueLoginRequest = function(value) {
+  return jspb.Message.setProto3BytesField(this, 1, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.toObject = function(opt_includeInstance) {
+  return proto.identity.auth.DeletePasswordUserFinishRequest.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    sessionId: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    opaqueLoginUpload: msg.getOpaqueLoginUpload_asB64()
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.identity.auth.DeletePasswordUserFinishRequest}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.identity.auth.DeletePasswordUserFinishRequest;
+  return proto.identity.auth.DeletePasswordUserFinishRequest.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.identity.auth.DeletePasswordUserFinishRequest}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setSessionId(value);
+      break;
+    case 2:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setOpaqueLoginUpload(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.identity.auth.DeletePasswordUserFinishRequest.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.identity.auth.DeletePasswordUserFinishRequest} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getSessionId();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getOpaqueLoginUpload_asU8();
+  if (f.length > 0) {
+    writer.writeBytes(
+      2,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string session_id = 1;
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.getSessionId = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.auth.DeletePasswordUserFinishRequest} returns this
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.setSessionId = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional bytes opaque_login_upload = 2;
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.getOpaqueLoginUpload = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * optional bytes opaque_login_upload = 2;
+ * This is a type-conversion wrapper around `getOpaqueLoginUpload()`
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.getOpaqueLoginUpload_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getOpaqueLoginUpload()));
+};
+
+
+/**
+ * optional bytes opaque_login_upload = 2;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getOpaqueLoginUpload()`
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.getOpaqueLoginUpload_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getOpaqueLoginUpload()));
+};
+
+
+/**
+ * @param {!(string|Uint8Array)} value
+ * @return {!proto.identity.auth.DeletePasswordUserFinishRequest} returns this
+ */
+proto.identity.auth.DeletePasswordUserFinishRequest.prototype.setOpaqueLoginUpload = function(value) {
+  return jspb.Message.setProto3BytesField(this, 2, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.toObject = function(opt_includeInstance) {
+  return proto.identity.auth.DeletePasswordUserStartResponse.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.identity.auth.DeletePasswordUserStartResponse} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    sessionId: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    opaqueLoginResponse: msg.getOpaqueLoginResponse_asB64()
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.identity.auth.DeletePasswordUserStartResponse}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.identity.auth.DeletePasswordUserStartResponse;
+  return proto.identity.auth.DeletePasswordUserStartResponse.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.identity.auth.DeletePasswordUserStartResponse} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.identity.auth.DeletePasswordUserStartResponse}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setSessionId(value);
+      break;
+    case 2:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setOpaqueLoginResponse(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.identity.auth.DeletePasswordUserStartResponse.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.identity.auth.DeletePasswordUserStartResponse} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getSessionId();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getOpaqueLoginResponse_asU8();
+  if (f.length > 0) {
+    writer.writeBytes(
+      2,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string session_id = 1;
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.getSessionId = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.identity.auth.DeletePasswordUserStartResponse} returns this
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.setSessionId = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional bytes opaque_login_response = 2;
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.getOpaqueLoginResponse = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * optional bytes opaque_login_response = 2;
+ * This is a type-conversion wrapper around `getOpaqueLoginResponse()`
+ * @return {string}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.getOpaqueLoginResponse_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getOpaqueLoginResponse()));
+};
+
+
+/**
+ * optional bytes opaque_login_response = 2;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getOpaqueLoginResponse()`
+ * @return {!Uint8Array}
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.getOpaqueLoginResponse_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getOpaqueLoginResponse()));
+};
+
+
+/**
+ * @param {!(string|Uint8Array)} value
+ * @return {!proto.identity.auth.DeletePasswordUserStartResponse} returns this
+ */
+proto.identity.auth.DeletePasswordUserStartResponse.prototype.setOpaqueLoginResponse = function(value) {
+  return jspb.Message.setProto3BytesField(this, 2, value);
+};
+
+
+
+
+
 if (jspb.Message.GENERATE_TO_OBJECT) {
 /**
  * Creates an object representation of this proto.
diff --git a/web/protobufs/identity-auth-structs.cjs.flow b/web/protobufs/identity-auth-structs.cjs.flow
--- a/web/protobufs/identity-auth-structs.cjs.flow
+++ b/web/protobufs/identity-auth-structs.cjs.flow
@@ -337,6 +337,68 @@
   opaqueRegistrationResponse: Uint8Array | string,
 };
 
+declare export class DeletePasswordUserStartRequest extends Message {
+  getOpaqueLoginRequest(): Uint8Array | string;
+  getOpaqueLoginRequest_asU8(): Uint8Array;
+  getOpaqueLoginRequest_asB64(): string;
+  setOpaqueLoginRequest(value: Uint8Array | string): DeletePasswordUserStartRequest;
+
+  serializeBinary(): Uint8Array;
+  toObject(includeInstance?: boolean): DeletePasswordUserStartRequestObject;
+  static toObject(includeInstance: boolean, msg: DeletePasswordUserStartRequest): DeletePasswordUserStartRequestObject;
+  static serializeBinaryToWriter(message: DeletePasswordUserStartRequest, writer: BinaryWriter): void;
+  static deserializeBinary(bytes: Uint8Array): DeletePasswordUserStartRequest;
+  static deserializeBinaryFromReader(message: DeletePasswordUserStartRequest, reader: BinaryReader): DeletePasswordUserStartRequest;
+}
+
+export type DeletePasswordUserStartRequestObject = {
+  opaqueLoginRequest: Uint8Array | string,
+}
+
+declare export class DeletePasswordUserFinishRequest extends Message {
+  getSessionId(): string;
+  setSessionId(value: string): DeletePasswordUserFinishRequest;
+
+  getOpaqueLoginUpload(): Uint8Array | string;
+  getOpaqueLoginUpload_asU8(): Uint8Array;
+  getOpaqueLoginUpload_asB64(): string;
+  setOpaqueLoginUpload(value: Uint8Array | string): DeletePasswordUserFinishRequest;
+
+  serializeBinary(): Uint8Array;
+  toObject(includeInstance?: boolean): DeletePasswordUserFinishRequestObject;
+  static toObject(includeInstance: boolean, msg: DeletePasswordUserFinishRequest): DeletePasswordUserFinishRequestObject;
+  static serializeBinaryToWriter(message: DeletePasswordUserFinishRequest, writer: BinaryWriter): void;
+  static deserializeBinary(bytes: Uint8Array): DeletePasswordUserFinishRequest;
+  static deserializeBinaryFromReader(message: DeletePasswordUserFinishRequest, reader: BinaryReader): DeletePasswordUserFinishRequest;
+}
+
+export type DeletePasswordUserFinishRequestObject = {
+  sessionId: string,
+  opaqueLoginUpload: Uint8Array | string,
+}
+
+declare export class DeletePasswordUserStartResponse extends Message {
+  getSessionId(): string;
+  setSessionId(value: string): DeletePasswordUserStartResponse;
+
+  getOpaqueLoginResponse(): Uint8Array | string;
+  getOpaqueLoginResponse_asU8(): Uint8Array;
+  getOpaqueLoginResponse_asB64(): string;
+  setOpaqueLoginResponse(value: Uint8Array | string): DeletePasswordUserStartResponse;
+
+  serializeBinary(): Uint8Array;
+  toObject(includeInstance?: boolean): DeletePasswordUserStartResponseObject;
+  static toObject(includeInstance: boolean, msg: DeletePasswordUserStartResponse): DeletePasswordUserStartResponseObject;
+  static serializeBinaryToWriter(message: DeletePasswordUserStartResponse, writer: BinaryWriter): void;
+  static deserializeBinary(bytes: Uint8Array): DeletePasswordUserStartResponse;
+  static deserializeBinaryFromReader(message: DeletePasswordUserStartResponse, reader: BinaryReader): DeletePasswordUserStartResponse;
+}
+
+export type DeletePasswordUserStartResponseObject = {
+  sessionId: string,
+  opaqueLoginResponse: Uint8Array | string,
+}
+
 export type SinceTimestampCase = 0 | 2;
 
 declare export class GetDeviceListRequest extends Message {