We have an IBM z/OS system that I am part of the administration team on which we often have to reset users' passwords. (forgotten, too many violations etc).

We do this my choosing a new password and assigning it to their id. We then email the user with their new password.

I know this is bad but am uncertain how we can improve the process?

My current idea is to provide a website which can produce a public and private RSA key pair, have them send us the public key which we then use to encrypt their new id and which they can then decrypt with the relevant private key.

What is the recommended process for systems whereby passwords resets are a manual process and the new password must be given back to the user?