When an admin creates a new account (admin/people/create), they're prompted to enter a password for the account. My client wants it to be that when an account is created in the back end, the admin doesn't have to enter a password, but the user is sent a notification message with a one-time log-in link and can then set a password after logging in using that. What's the best way to achieve something like this?

I've thought of maybe altering the form to set the #default_value of the password fields to a random password and then setting '#access' => FALSE, but I'm not sure if that's the best way to go about it.

3 Answers 3


There is a module that does this.

Check out Generate Password.

It introduces this additional setting in Configuration » People » Account settings:

Users may enter a password on registration. If left empty, a random password will be generated. This always applies when an administrator is creating the account.

Then, when creating the account, leave the password field empty, but make sure you also check this checkbox on the "Add user" page:

Notify user of new account

The result of these two settings is that the module generates a random password when the administrator creates an account, and the user is sent an email with a notification about the account and prompted to set a password in the one-time login link that is included in the notification.

If you want to learn how it is done, read the source code.

  • 2
    This module's first lines of code are using hook_init() to drupal_add_css() on every page load… it's also duplicating core's user_password(). Doesn't pass the smell test. Jun 1, 2014 at 1:06
  • Agree, @GarrettAlbright — think it makes sense to improve (and simplify) GenPass or make a new module... or fit it in an existing admin experience module?
    – mlncn
    Sep 25, 2014 at 13:14
  • How frequently do the admin have to do this? In my case, it is something like: Every other month. This means I can live with GenPass not being super-optimized. If you're doing this all the times, you may want to spend some time improving GenPass or writing a better module. Sep 25, 2014 at 13:37
  • I can't recall the specifics, but IIRC I just took the approach I mention in my OP; hiding the password field and just setting one randomly using user_password(mt_rand(10, 50)) or something like that upon form submission. Sep 25, 2014 at 16:41
  • @FreeRadical if it's adding CSS to every page load, then surely it doesn't matter how ofter you use the feature - it will slow down every single page that gets served
    – AdamS
    Apr 27, 2015 at 10:40

AdamS's answer is almost there. Since the password field will be expanded into two subfields ("pass1" and "pass2") when the element is processed (form_process_password_confirm()), you need something like:

 * Implements hook_form_FORM_ID_alter().
function acfo_common_form_user_register_form_alter(&$form, &$form_state, $form_id) {
  // Do special for user admins.
  if ($form['administer_users']['#value']) {
    // Default to sending user an account creation notification.
    $form['account']['notify']['#default_value'] = 1;

    // We'll send a one-time login link in lieu of setting a password here.
    $pass = user_password();
    $form['account']['pass']['#value'] = array(
      'pass1' => $pass,
      'pass2' => $pass,
    $form['account']['pass']['#access'] = FALSE;
  • Thanks I have updated my answer (and given you credit!). It turns out that I already had the working code on my server but must have accidentally copied an older version into the answer, sorry.
    – AdamS
    Feb 20, 2016 at 19:59
  • 1
    One note on this is that user_password is deprecated in Drupal 9 and will be removed in 10.0. See drupal.org/node/3153113 which explains that is replaced with \Drupal::service('password_generator')->generate()
    – shelane
    May 4, 2021 at 18:22
  • You mau add $form['account']['notify']['#disabled'] = TRUE; to be sure the user gets a notification and can then change the password
    – abelass
    Jan 11, 2022 at 10:39

If you don't fancy installing the "Generate Password" module and are comfortable using hooks, then here is an alternative:

 * Implements hook_form_FORM_ID_alter().
 * Remove the password field when admin is creating an account.
function HOOK_form_user_register_form_alter(&$form, &$form_state, $form_id) {
  if ($form['administer_users']['#value']) {
    $form['account']['pass']['#access'] = FALSE;
    $form['account']['pass']['#value']['pass1'] = user_password();
    $form['account']['pass']['#value']['pass2'] = $form['account']['pass']['#value']['pass1'];

You could make it more sophisticated to your taste. As it stands it always hides the password field and provides a value instead - the admin will have to edit the newly account to set a specific value. Also it leaves the "notify" default to off, whereas you might prefer on.

Updated as per @joe_flash answer (but in a slightly more compact form): the password field will be expanded into two subfields ("pass1" and "pass2") when the element is processed.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.