diff --git a/Gemfile b/Gemfile
index 38a7995..f542974 100644
--- a/Gemfile
+++ b/Gemfile
@@ -20,6 +20,8 @@ gem "image_processing", "~> 1.2"
 gem "solid_queue"
 gem "mission_control-jobs"
 
+gem "active_storage_validations"
+
 group :development, :test do
   gem "debug", platforms: %i[ mri windows ]
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 034a4ab..c9ef976 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -50,6 +50,11 @@ GEM
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
+    active_storage_validations (1.1.4)
+      activejob (>= 5.2.0)
+      activemodel (>= 5.2.0)
+      activestorage (>= 5.2.0)
+      activesupport (>= 5.2.0)
     activejob (7.1.3.3)
       activesupport (= 7.1.3.3)
       globalid (>= 0.3.6)
@@ -314,6 +319,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  active_storage_validations
   bcrypt (~> 3.1.7)
   bootsnap
   capybara
diff --git a/app/assets/stylesheets/forms.css b/app/assets/stylesheets/forms.css
index 219fceb..6cd93b0 100644
--- a/app/assets/stylesheets/forms.css
+++ b/app/assets/stylesheets/forms.css
@@ -32,7 +32,7 @@ form, fieldset {
     font-size: .8em;
   }
 
-  fieldset, p, trix-editor {
+  fieldset, p, trix-editor, hr {
     grid-column: 1/3;
   }
 
diff --git a/app/assets/stylesheets/layout.css b/app/assets/stylesheets/layout.css
index ab4a1ce..10c49a8 100644
--- a/app/assets/stylesheets/layout.css
+++ b/app/assets/stylesheets/layout.css
@@ -59,3 +59,7 @@ header nav {
     color: var(--button-hover-text-color);
   }
 }
+
+hr {
+  width: 100%;
+}
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index c589672..95d6a5f 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -61,6 +61,7 @@ class UsersController < ApplicationController
         :first_name,
         :last_name,
         :profile,
+        :avatar,
       )
     end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 69486c0..efe6fd9 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -6,6 +6,11 @@ class User < ApplicationRecord
   has_many :players, dependent: :destroy
   has_many :tables, through: :players
   has_rich_text :profile
+  has_one_attached :avatar do |attachable|
+    attachable.variant :standard, resize_to_limit: [ 100, 100 ], preprocessed: true
+  end
+  validates :avatar, content_type: /\Aimage\/.*\z/,
+                     dimension: { width: { in: 10..1000 }, height: { in: 10..1000 } }
 
   has_secure_password
   generates_token_for :password_reset, expires_in: 4.hours do
diff --git a/app/views/users/_form.html.erb b/app/views/users/_form.html.erb
index f469edd..d001b30 100644
--- a/app/views/users/_form.html.erb
+++ b/app/views/users/_form.html.erb
@@ -38,7 +38,13 @@
       <%= display_form_errors(user, :password_confirmation) %>
     </fieldset>
 
+    <hr>
+
     <% if user.persisted? %>
+      <%= f.label :avatar %>
+      <%= f.file_field :avatar %>
+      <%= display_form_errors(user, :avatar) %>
+
       <%= f.label :profile %>
       <%= f.rich_text_area :profile %>
       <%= display_form_errors(user, :profile) %>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 467d4dd..da9a0bc 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -1,6 +1,7 @@
 <%= content_for :title, @user.username %>
 
 <h2><%= @user.username %></h2>
+<%= image_tag(url_for(@user.avatar.variant(:standard)), width: "100px", height: "100px") if @user.avatar.attached? %>
 
 <aside>
   <% if @user == Current.user %>
diff --git a/todo.md b/todo.md
index 614daff..6cf5e1a 100644
--- a/todo.md
+++ b/todo.md
@@ -1,5 +1,7 @@
 - avatars
-- list invites on user page
+  - delete avatar
+  - default avatars
+- discrete password page
 - notifications
 - Add characters to users/tables
 - Character sheets/prototypes