I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?

1 Answer 1


Don't transmit a password at all. Set the password to something completely random, then automate a password reset. This will create a one-time link that allows them to log in, and forces them to change the password immediately.

Benefits of this scheme:

  • A valid password is never sent in cleartext.
  • The one-time link is useless after one use, so an attacker stealing the link later isn't a problem.
  • The user is prompted to create a password immediately, so the account is secure the instant they start to use it.
  • You know when a user has logged in successfully for the furst time, which allows you to send them an email thanking them for their custom. Furthermore, you could send out an email to any unactivated account after 12 hours or so, reminding them to use the link to set up their password.
  • I'm assuming the difference between sending an expire-on-login password and a one-time-link is that the link can be used only once, and would have to be re-requested, whereas the user might decline to create a new password (forgoing the ability to use the site, but leaving the password eligible). Or have I missed something here? Aug 3, 2012 at 20:46
  • Pretty much, yeah. The point is that once the link is used, it's used, and the user has set their own password. With a one-time password, you are transmitting a token that is usable for more than one login.
    – Polynomial
    Aug 4, 2012 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .