Change password of a user in a REST API

I'm developing a small REST API. I have a user resource with this fields in my database:

{
  email: String,
  password: String,
  first_name: String,
  last_name: String,
  age: Number,
  location: String
}

When I query a specific user resource I'm returning all the fields except the password field for security reasons.

Now I want to make a form in the client side so a user can update his personal information and his password. The change password form will have two inputs: old_password and new_password.

Here comes my doubt. I want to have a PUT method so I can send all the fields and update the user. But the old_password and new_password will rarely be filled so they cannot be send to the server every time the user makes a PUT request.

• Is it ok to send that two fields sometimes to a PUT method? Is it RESTful?

• Other idea is to have a PATCH method with that two fields and only update the user password. But then my PUT method is not updating the user password and it's not being correctly used right?

Which is the most RESTful approach? Thanks.