diff --git a/Dockerfile b/Dockerfile
index eb2daad..ba6feb4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
-FROM quay.io/keycloak/keycloak:21.0.1 as builder
+FROM quay.io/keycloak/keycloak:23.0.3 as builder
 ENV KC_DB=postgres
 COPY target/keycloak-ekklesia.jar /opt/keycloak/providers/
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:21.0.1
+FROM quay.io/keycloak/keycloak:23.0.3
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 WORKDIR /opt/keycloak
 ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized", "--spi-theme-welcome-theme=keycloak-ekklesia-pirates", "--spi-user-profile-declarative-user-profile-read-only-attributes=ekklesia*"]
diff --git a/keycloak-plugin/pom.xml b/keycloak-plugin/pom.xml
index e6b7211..f8fa6ce 100644
--- a/keycloak-plugin/pom.xml
+++ b/keycloak-plugin/pom.xml
@@ -2,7 +2,7 @@
     <modelVersion>4.0.0</modelVersion>
 
     <properties>
-        <keycloak.version>21.0.1</keycloak.version>
+        <keycloak.version>23.0.3</keycloak.version>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
     </properties>
diff --git a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia-pirates/account/messages/messages_de.properties b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia-pirates/account/messages/messages_de.properties
index 11d0647..f10d6c7 100644
--- a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia-pirates/account/messages/messages_de.properties
+++ b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia-pirates/account/messages/messages_de.properties
@@ -73,4 +73,4 @@ enterYourVerficationCode=Gib deinen Verifizierungscode ein
 backupcodesIntroMessage=Wenn du den Zugriff auf dein Telefon verlierst, kannst du dich immer noch \u00FCber Backup-Codes bei deinem Konto anmelden. Bewahre diese an einem sicheren und zug\u00E4nglichen Ort auf.
 backupCodesTips-3=Wenn du neue Backup-Codes generierst, werden die aktuellen Codes nicht mehr funktionieren.
 
-updateReadOnlyAttributesRejectedMessage=Änderung von schreibgeschützten Eigenschaften fehlgeschlagen
+updateReadOnlyAttributesRejectedMessage=\u00C4nderung von schreibgesch\u00FCtzten Eigenschaften fehlgeschlagen
diff --git a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login-update-profile.ftl b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login-update-profile.ftl
index 879c41f..9c2eb6e 100644
--- a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login-update-profile.ftl
+++ b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login-update-profile.ftl
@@ -23,23 +23,25 @@
                     </div>
                 </div>
             </#if>
-            <div class="${properties.kcFormGroupClass!}">
-                <div class="${properties.kcLabelWrapperClass!}">
-                    <label for="email" class="${properties.kcLabelClass!}">${msg("email")}</label>
-                </div>
-                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" name="email" value="${(user.email!'')}"
-                           class="${properties.kcInputClass!}"
-                           aria-invalid="<#if messagesPerField.existsError('email')>true</#if>"
-                    />
+            <#if user.editEmailAllowed>
+                <div class="${properties.kcFormGroupClass!}">
+                    <div class="${properties.kcLabelWrapperClass!}">
+                        <label for="email" class="${properties.kcLabelClass!}">${msg("email")}</label>
+                    </div>
+                    <div class="${properties.kcInputWrapperClass!}">
+                        <input type="text" id="email" name="email" value="${(user.email!'')}"
+                            class="${properties.kcInputClass!}"
+                            aria-invalid="<#if messagesPerField.existsError('email')>true</#if>"
+                        />
 
-                    <#if messagesPerField.existsError('email')>
-                        <span id="input-error-email" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
-                            ${kcSanitize(messagesPerField.get('email'))?no_esc}
-                        </span>
-                    </#if>
+                        <#if messagesPerField.existsError('email')>
+                            <span id="input-error-email" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+                                ${kcSanitize(messagesPerField.get('email'))?no_esc}
+                            </span>
+                        </#if>
+                    </div>
                 </div>
-            </div>
+            </#if>
 
             <div class="${properties.kcFormGroupClass!}" style="display:none">
                 <div class="${properties.kcLabelWrapperClass!}">
diff --git a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login.ftl b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login.ftl
index a7c843f..7790d66 100644
--- a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login.ftl
+++ b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/login.ftl
@@ -1,91 +1,116 @@
 <#import "template.ftl" as layout>
 <@layout.registrationLayout displayMessage=!messagesPerField.existsError('username','password') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
     <#if section = "header">
-        ${msg("doLogIn")}
+        ${msg("loginAccountTitle")}
     <#elseif section = "form">
-    <div id="kc-form">
-      <div>${msg("loginInfoText")}<br /><br /></div>
-      <div id="kc-form-wrapper">
-        <#if realm.password>
-            <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
-                <div class="${properties.kcFormGroupClass!}">
-                    <label for="username" class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
+        <div id="kc-form">
+        <div>${msg("loginInfoText")}<br /><br /></div>
+        <div id="kc-form-wrapper">
+            <#if realm.password>
+                <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
+                    <#if !usernameHidden??>
+                        <div class="${properties.kcFormGroupClass!}">
+                            <label for="username" class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
 
-                    <#if usernameEditDisabled??>
-                        <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}" type="text" disabled />
-                    <#else>
-                        <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}"  type="text" autofocus autocomplete="off" aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>" />
-                        <#if messagesPerField.existsError('username','password')>
-                             <span id="input-error" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
-                                     ${kcSanitize(messagesPerField.getFirstError('username','password'))?no_esc}
-                             </span>
-                         </#if>
+                            <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}"  type="text" autofocus autocomplete="off"
+                                    aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
+                                />
+
+                            <#if messagesPerField.existsError('username','password')>
+                                <span id="input-error" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+                                        ${kcSanitize(messagesPerField.getFirstError('username','password'))?no_esc}
+                                </span>
+                            </#if>
+
+                        </div>
                     </#if>
-                </div>
 
-                <div class="${properties.kcFormGroupClass!}">
-                    <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
-                    <input tabindex="2" id="password" class="${properties.kcInputClass!}" name="password" type="password" autocomplete="off" aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>" />
-                </div>
+                    <div class="${properties.kcFormGroupClass!}">
+                        <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
 
-                <div class="${properties.kcFormGroupClass!} ${properties.kcFormSettingClass!}">
-                    <div id="kc-form-options">
-                        <#if realm.rememberMe && !usernameEditDisabled??>
-                            <div class="checkbox">
-                                <label>
-                                    <#if login.rememberMe??>
-                                        <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox" checked> ${msg("rememberMe")}
-                                    <#else>
-                                        <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox"> ${msg("rememberMe")}
-                                    </#if>
-                                </label>
+                        <div class="${properties.kcInputGroup!}">
+                                <input tabindex="2" id="password" class="${properties.kcInputClass!}" name="password" type="password" autocomplete="off"
+                                    aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
+                                />
+                                <button class="${properties.kcFormPasswordVisibilityButtonClass!}" type="button" aria-label="${msg("showPassword")}"
+                                        aria-controls="password"  data-password-toggle
+                                        data-icon-show="${properties.kcFormPasswordVisibilityIconShow!}" data-icon-hide="${properties.kcFormPasswordVisibilityIconHide!}"
+                                        data-label-show="${msg('showPassword')}" data-label-hide="${msg('hidePassword')}">
+                                    <i class="${properties.kcFormPasswordVisibilityIconShow!}" aria-hidden="true"></i>
+                                </button>
                             </div>
-                        </#if>
-                        </div>
-                        <div class="${properties.kcFormOptionsWrapperClass!}">
-                            <#if realm.resetPasswordAllowed>
-                                <span><a tabindex="5" href="${url.loginResetCredentialsUrl}">${msg("doForgotPassword")}</a></span>
+
+                            <#if usernameHidden?? && messagesPerField.existsError('username','password')>
+                                <span id="input-error" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+                                        ${kcSanitize(messagesPerField.getFirstError('username','password'))?no_esc}
+                                </span>
                             </#if>
-                        </div>
 
-                  </div>
+                    </div>
 
-                  <div id="kc-form-buttons" class="${properties.kcFormGroupClass!}">
-                      <input type="hidden" id="id-hidden-input" name="credentialId" <#if auth.selectedCredential?has_content>value="${auth.selectedCredential}"</#if>/>
-                      <input tabindex="4" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="login" id="kc-login" type="submit" value="${msg("doLogIn")}"/>
-                  </div>
-            </form>
-        </#if>
+                    <div class="${properties.kcFormGroupClass!} ${properties.kcFormSettingClass!}">
+                        <div id="kc-form-options">
+                            <#if realm.rememberMe && !usernameHidden??>
+                                <div class="checkbox">
+                                    <label>
+                                        <#if login.rememberMe??>
+                                            <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox" checked> ${msg("rememberMe")}
+                                        <#else>
+                                            <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox"> ${msg("rememberMe")}
+                                        </#if>
+                                    </label>
+                                </div>
+                            </#if>
+                            </div>
+                            <div class="${properties.kcFormOptionsWrapperClass!}">
+                                <#if realm.resetPasswordAllowed>
+                                    <span><a tabindex="5" href="${url.loginResetCredentialsUrl}">${msg("doForgotPassword")}</a></span>
+                                </#if>
+                            </div>
+
+                    </div>
+
+                    <div id="kc-form-buttons" class="${properties.kcFormGroupClass!}">
+                        <input type="hidden" id="id-hidden-input" name="credentialId" <#if auth.selectedCredential?has_content>value="${auth.selectedCredential}"</#if>/>
+                        <input tabindex="4" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="login" id="kc-login" type="submit" value="${msg("doLogIn")}"/>
+                    </div>
+                </form>
+            </#if>
+            </div>
         </div>
+        <script type="module" src="${url.resourcesPath}/js/passwordVisibility.js"></script>
+    <#elseif section = "info" >
+        <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
+            <div id="kc-registration-container">
+                <div id="kc-registration">
+                    <span>${msg("noAccount")} <a tabindex="6"
+                                                    href="${url.registrationUrl}">${msg("doRegister")}</a></span>
+                </div>
+            </div>
+        </#if>
+    <#elseif section = "socialProviders" >
         <#if realm.password && social.providers??>
-            <div id="kc-social-providers" class="${properties.kcFormSocialAccountContentClass!}>
+            <div id="kc-social-providers" class="${properties.kcFormSocialAccountSectionClass!}">
                 <hr/>
                 <h4>${msg("identity-provider-login-label")}</h4>
+
                 <ul class="${properties.kcFormSocialAccountListClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">
                     <#list social.providers as p>
-                         <a id="social-${p.alias}" class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
-                                 type="button" href="${p.loginUrl}">
-                             <#if p.iconClasses?has_content>
-                                 <i class="${properties.kcCommonLogoIdP!} ${p.iconClasses!}" aria-hidden="true"></i>
-                                 <span class="${properties.kcFormSocialAccountNameClass!} kc-social-icon-text">${p.displayName!}</span>
-                             <#else>
-                                 <span class="${properties.kcFormSocialAccountNameClass!}">${p.displayName!}</span>
-                             </#if>
-                         </a>
+                        <li>
+                            <a id="social-${p.alias}" class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
+                                    type="button" href="${p.loginUrl}">
+                                <#if p.iconClasses?has_content>
+                                    <i class="${properties.kcCommonLogoIdP!} ${p.iconClasses!}" aria-hidden="true"></i>
+                                    <span class="${properties.kcFormSocialAccountNameClass!} kc-social-icon-text">${p.displayName!}</span>
+                                <#else>
+                                    <span class="${properties.kcFormSocialAccountNameClass!}">${p.displayName!}</span>
+                                </#if>
+                            </a>
+                        </li>
                     </#list>
                 </ul>
             </div>
         </#if>
-      </div>
-    <#elseif section = "info" >
-        <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
-            <div id="kc-registration-container">
-                 <div id="kc-registration">
-                     <span>${msg("noAccount")} <a tabindex="6"
-                                                  href="${url.registrationUrl}">${msg("doRegister")}</a></span>
-                 </div>
-            </div>
-        </#if>
     </#if>
 
 </@layout.registrationLayout>
diff --git a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/register.ftl b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/register.ftl
index ebd02ad..bfdd35e 100644
--- a/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/register.ftl
+++ b/keycloak-theme/src/main/resources/theme/keycloak-ekklesia/login/register.ftl
@@ -1,5 +1,6 @@
 <#import "template.ftl" as layout>
-<@layout.registrationLayout displayMessage=!messagesPerField.existsError('firstName','lastName','email','username','password','password-confirm'); section>
+<#import "register-commons.ftl" as registerCommons>
+<@layout.registrationLayout displayMessage=!messagesPerField.existsError('firstName','lastName','email','username','password','password-confirm','termsAccepted'); section>
     <#if section = "header">
         ${msg("registerTitle")}
     <#elseif section = "form">
@@ -85,10 +86,19 @@
                         <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
                     </div>
                     <div class="${properties.kcInputWrapperClass!}">
-                        <input type="password" id="password" class="${properties.kcInputClass!}" name="password"
-                               autocomplete="new-password"
-                               aria-invalid="<#if messagesPerField.existsError('password','password-confirm')>true</#if>"
-                        />
+                        <div class="${properties.kcInputGroup!}">
+                            <input type="password" id="password" class="${properties.kcInputClass!}" name="password"
+                                autocomplete="new-password"
+                                aria-invalid="<#if messagesPerField.existsError('password','password-confirm')>true</#if>"
+                            />
+                            <button class="${properties.kcFormPasswordVisibilityButtonClass!}" type="button" aria-label="${msg('showPassword')}"
+                                    aria-controls="password"  data-password-toggle
+                                    data-icon-show="${properties.kcFormPasswordVisibilityIconShow!}" data-icon-hide="${properties.kcFormPasswordVisibilityIconHide!}"
+                                    data-label-show="${msg('showPassword')}" data-label-hide="${msg('hidePassword')}">
+                                <i class="${properties.kcFormPasswordVisibilityIconShow!}" aria-hidden="true"></i>
+                            </button>
+                        </div>
+
 
                         <#if messagesPerField.existsError('password')>
                             <span id="input-error-password" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
@@ -104,10 +114,18 @@
                                class="${properties.kcLabelClass!}">${msg("passwordConfirm")}</label>
                     </div>
                     <div class="${properties.kcInputWrapperClass!}">
-                        <input type="password" id="password-confirm" class="${properties.kcInputClass!}"
-                               name="password-confirm"
-                               aria-invalid="<#if messagesPerField.existsError('password-confirm')>true</#if>"
-                        />
+                        <div class="${properties.kcInputGroup!}">
+                            <input type="password" id="password-confirm" class="${properties.kcInputClass!}"
+                                name="password-confirm"
+                                aria-invalid="<#if messagesPerField.existsError('password-confirm')>true</#if>"
+                            />
+                            <button class="${properties.kcFormPasswordVisibilityButtonClass!}" type="button" aria-label="${msg('showPassword')}"
+                                    aria-controls="password-confirm"  data-password-toggle
+                                    data-icon-show="${properties.kcFormPasswordVisibilityIconShow!}" data-icon-hide="${properties.kcFormPasswordVisibilityIconHide!}"
+                                    data-label-show="${msg('showPassword')}" data-label-hide="${msg('hidePassword')}">
+                                <i class="${properties.kcFormPasswordVisibilityIconShow!}" aria-hidden="true"></i>
+                            </button>
+                        </div>
 
                         <#if messagesPerField.existsError('password-confirm')>
                             <span id="input-error-password-confirm" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
@@ -137,6 +155,8 @@
                 </div>
             </div>
 
+            <@registerCommons.termsAcceptance/>
+
             <#if recaptchaRequired??>
                 <div class="form-group">
                     <div class="${properties.kcInputWrapperClass!}">
@@ -157,5 +177,6 @@
                 </div>
             </div>
         </form>
+        <script type="module" src="${url.resourcesPath}/js/passwordVisibility.js"></script>
     </#if>
 </@layout.registrationLayout>