I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
Don't transmit a password at all. Set the password to something completely random, then automate a password reset. This will create a one-time link that allows them to log in, and forces them to change the password immediately.
Benefits of this scheme:
- A valid password is never sent in cleartext.
- The one-time link is useless after one use, so an attacker stealing the link later isn't a problem.
- The user is prompted to create a password immediately, so the account is secure the instant they start to use it.
- You know when a user has logged in successfully for the furst time, which allows you to send them an email thanking them for their custom. Furthermore, you could send out an email to any unactivated account after 12 hours or so, reminding them to use the link to set up their password.