This question already has an answer here:
I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons.
In order to mitigate the increased risk of inputting a wrong password by mistake, is it ok to send the password in the welcome email to the user? This would happen in the code that handles the form response. The password is then hashed (bcrypt) and stored, so cannot be retrieved in future.
My reasoning is that an attacker who has gained access to the user's email account can reset the password on this service anyway using the standard password reset tools, so storing a copy in their inbox is not any more of a security risk than having email-based reset.
Is there a flaw in my thinking?