This question already has an answer here:
I am creating a mobile app where my password recovery feature involves sending a password recovery code (randomly generated string) to the user's email address. They get the code, then enters it within the app. The webservices check if the code is valid (this expires after 24 hours) and then if it is, the app takes the user to update their password.
I would use a password reset link but I'm not great at programming and I'm looking at alternatives for now.
In terms of security, is sending the randomized code to the user's email just as bad as emailing the password in plain text? Even though I will be using the Blowfish cipher to encrypt the code when it is stored in the database?
To clarify this is asking about emailing password recovery codes/tokens and not about passwords