You are asking us for the best way to shoot yourself in the foot. As Peter Harmann says, there is absolutely no legitimate reason to do password recovery by decrypting and emailing passwords. If you can decrypt the passwords, an attacker could potentially do the same. The whole point of password hashing is to avoid that! Additionally, email is not a very safe medium so littering peoples inboxes with passwords is not good practice.
So what to do instead? The traditional way to do password recovery is to email a password reset link to the user. The link contains a securely random, long token connected to the user. This token allows the person clicking the link to change the password once. Note that the token should expire within some reasonable time. If you want to learn more, Troy Hunt has a nice article on it.
While you are at it, there are some important things you need to do to improve your password hashing:
- Most importantly, and this is a major deal, do not use a single round of SHA-256. This is not nearly good enough. You need to use a slow algorithm, like bcrypt or similar. See this question.
- It is better to use a random salt than to use the username. This isn't as important as the above point, but it's still good practice.