diff --git a/amanuensis/backend/user.py b/amanuensis/backend/user.py
index 8fc0c67..1283fb2 100644
--- a/amanuensis/backend/user.py
+++ b/amanuensis/backend/user.py
@@ -61,7 +61,7 @@ def create(
 
     new_user = User(
         username=username,
-        password=password,
+        password=generate_password_hash(password),
         display_name=display_name,
         email=email,
         is_site_admin=is_site_admin,
diff --git a/tests/backend/test_lexicon.py b/tests/backend/test_lexicon.py
index 9e1c400..41caef4 100644
--- a/tests/backend/test_lexicon.py
+++ b/tests/backend/test_lexicon.py
@@ -1,10 +1,9 @@
-from amanuensis.db.models import Lexicon
 import datetime
 
 import pytest
 
-from amanuensis.db import DbContext
 import amanuensis.backend.lexicon as lexiq
+from amanuensis.db import DbContext, Lexicon, User
 from amanuensis.errors import ArgumentError
 
 
@@ -51,3 +50,50 @@ def test_create_lexicon(db: DbContext):
     # No duplicate lexicon names
     with pytest.raises(ArgumentError):
         lexiq.create(**defaults)
+
+
+def test_lexicon_from(db: DbContext, make):
+    """Test lexiq.from_*."""
+    lexicon1: Lexicon = make.lexicon()
+    lexicon2: Lexicon = make.lexicon()
+    assert lexiq.from_name(db, lexicon1.name) == lexicon1
+    assert lexiq.from_name(db, lexicon2.name) == lexicon2
+
+
+def test_get_lexicon(db: DbContext, make):
+    """Test the various scoped get functions."""
+    user: User = make.user()
+
+    public_joined: Lexicon = make.lexicon()
+    public_joined.public = True
+    make.membership(user_id=user.id, lexicon_id=public_joined.id)
+
+    private_joined: Lexicon = make.lexicon()
+    private_joined.public = False
+    make.membership(user_id=user.id, lexicon_id=private_joined.id)
+
+    public_open: Lexicon = make.lexicon()
+    public_open.public = True
+    db.session.commit()
+
+    private_open: Lexicon = make.lexicon()
+    private_open.public = False
+    db.session.commit()
+
+    get_all = list(lexiq.get_all(db))
+    assert public_joined in get_all
+    assert private_joined in get_all
+    assert public_open in get_all
+    assert private_open in get_all
+
+    get_joined = list(lexiq.get_joined(db, user.id))
+    assert public_joined in get_joined
+    assert private_joined in get_joined
+    assert public_open not in get_joined
+    assert private_open not in get_joined
+
+    get_public = list(lexiq.get_public(db))
+    assert public_joined in get_public
+    assert private_joined not in get_public
+    assert public_open in get_public
+    assert private_open not in get_public
diff --git a/tests/backend/test_user.py b/tests/backend/test_user.py
index f1e8b76..e5fc571 100644
--- a/tests/backend/test_user.py
+++ b/tests/backend/test_user.py
@@ -1,8 +1,9 @@
-from amanuensis.db.models import User
+import os
+
 import pytest
 
-from amanuensis.db import DbContext
 import amanuensis.backend.user as userq
+from amanuensis.db import DbContext, User
 from amanuensis.errors import ArgumentError
 
 
@@ -50,3 +51,26 @@ def test_create_user(db: DbContext):
     user2_kw: dict = {**defaults, "username": "user2", "display_name": None}
     user2: User = userq.create(**user2_kw)
     assert user2.display_name is not None
+
+
+def test_user_from(db: DbContext, make):
+    """Test userq.from_*."""
+    user1: User = make.user()
+    user2: User = make.user()
+    assert userq.from_id(db, user1.id) == user1
+    assert userq.from_username(db, user1.username) == user1
+    assert userq.from_id(db, user2.id) == user2
+    assert userq.from_username(db, user2.username) == user2
+
+
+def test_user_password(db: DbContext, make):
+    """Test user password functions."""
+    pw1 = os.urandom(8).hex()
+    pw2 = os.urandom(8).hex()
+    user: User = make.user(password=pw1)
+    assert userq.password_check(db, user.username, pw1)
+    assert not userq.password_check(db, user.username, pw2)
+
+    userq.password_set(db, user.username, pw2)
+    assert not userq.password_check(db, user.username, pw1)
+    assert userq.password_check(db, user.username, pw2)