I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user profile, based on their email address, and then want the site to email them telling them that their profile is ready for use.

However, I'm not sure of the safest way to let people know of their password. In a normal registration, the user enters their password of choice, which is hashed and stored. All that remains is to send them a link to verify their email address.

In our case, they don't register, so don't supply a password. Whats the safest way to proceed?

This answer suggests sending them a link to a page where they can see their password, but I'm not sure if that has any benefits over sending them to a page where they can enter their own password. Actually, I think the latter suggestion is better, as if the password has already been set, the web page can inform them that the password has been set, and if this wasn't them, to contact the admins immediately.

Anyone any suggestions or comments?

I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user profile, based on their email address, and then want the site to email them telling them that their profile is ready for use.

However, I'm not sure of the safest way to let people know of their password. In a normal registration, the user enters their password of choice, which is hashed and stored. All that remains is to send them a link to verify their email address.

In our case, they don't register, so don't supply a password. Whats the safest way to proceed?

This answer suggests sending them a link to a page where they can see their password, but I'm not sure if that has any benefits over sending them to a page where they can enter their own password. Actually, I think the latter suggestion is better, as if the password has already been set, the web page can inform them that the password has been set, and if this wasn't them, to contact the admins immediately.

What would be the best way to inform a new user of their password, security-wise?

Hope this is the right forum for this.

I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user profile, based on their email address, and then want the site to email them telling them that their profile is ready for use.

However, I'm not sure of the safest way to let people know of their password. In a normal registration, the user enters their password of choice, which is hashed and stored. All that remains is to send them a link to verify their email address.

In our case, they don't register, so don't supply a password. Whats the safest way to proceed?

This answer suggests sending them a link to a page where they can see their password, but I'm not sure if that has any benefits over sending them to a page where they can enter their own password. Actually, I think the latter suggestion is better, as if the password has already been set, the web page can inform them that the password has been set, and if this wasn't them, to contact the admins immediately.

Anyone any suggestions or comments? Thanks

I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user profile, based on their email address, and then want the site to email them telling them that their profile is ready for use.

However, I'm not sure of the safest way to let people know of their password. In a normal registration, the user enters their password of choice, which is hashed and stored. All that remains is to send them a link to verify their email address.

In our case, they don't register, so don't supply a password. Whats the safest way to proceed?

This answer suggests sending them a link to a page where they can see their password, but I'm not sure if that has any benefits over sending them to a page where they can enter their own password. Actually, I think the latter suggestion is better, as if the password has already been set, the web page can inform them that the password has been set, and if this wasn't them, to contact the admins immediately.

Anyone any suggestions or comments?