When an admin creates a new account (admin/people/create), they're prompted to enter a password for the account. My client wants it to be that when an account is created in the back end, the admin doesn't have to enter a password, but the user is sent a notification message with a one-time log-in link and can then set a password after logging in using that. What's the best way to achieve something like this?

I've thought of maybe altering the form to set the #default_value of the password fields to a random password and then setting '#access' => FALSE, but I'm not sure if that's the best way to go about it.


There is a module that does this.

Check out Generate Password.

It introduces this additional setting in Configuration » People » Account settings:

Users may enter a password on registration. If left empty, a random password will be generated. This always applies when an administrator is creating the account.

Then, when creating the account, leave the password field empty, but make sure you also check this checkbox on the "Add user" page:

Notify user of new account

The result of these two settings is that the module generates a random password when the administrator creates an account, and the user is sent an email with a notification about the account and prompted to set a password in the one-time login link that is included in the notification.

If you want to learn how it is done, read the source code.

  • 2
    This module's first lines of code are using hook_init() to drupal_add_css() on every page load… it's also duplicating core's user_password(). Doesn't pass the smell test. – Garrett Albright Jun 1 '14 at 1:06
  • Agree, @GarrettAlbright — think it makes sense to improve (and simplify) GenPass or make a new module... or fit it in an existing admin experience module? – mlncn Sep 25 '14 at 13:14
  • How frequently do the admin have to do this? In my case, it is something like: Every other month. This means I can live with GenPass not being super-optimized. If you're doing this all the times, you may want to spend some time improving GenPass or writing a better module. – Free Radical Sep 25 '14 at 13:37
  • I can't recall the specifics, but IIRC I just took the approach I mention in my OP; hiding the password field and just setting one randomly using user_password(mt_rand(10, 50)) or something like that upon form submission. – Garrett Albright Sep 25 '14 at 16:41
  • @FreeRadical if it's adding CSS to every page load, then surely it doesn't matter how ofter you use the feature - it will slow down every single page that gets served – AdamS Apr 27 '15 at 10:40

If you don't fancy installing the "Generate Password" module and are comfortable using hooks, then here is an alternative:

 * Implements hook_form_FORM_ID_alter().
 * Remove the password field when admin is creating an account.
function HOOK_form_user_register_form_alter(&$form, &$form_state, $form_id) {
  if ($form['administer_users']['#value']) {
    $form['account']['pass']['#access'] = FALSE;
    $form['account']['pass']['#value']['pass1'] = user_password();
    $form['account']['pass']['#value']['pass2'] = $form['account']['pass']['#value']['pass1'];

You could make it more sophisticated to your taste. As it stands it always hides the password field and provides a value instead - the admin will have to edit the newly account to set a specific value. Also it leaves the "notify" default to off, whereas you might prefer on.

Updated as per @joe_flash answer (but in a slightly more compact form): the password field will be expanded into two subfields ("pass1" and "pass2") when the element is processed.


AdamS's answer is almost there. Since the password field will be expanded into two subfields ("pass1" and "pass2") when the element is processed (form_process_password_confirm()), you need something like:

 * Implements hook_form_FORM_ID_alter().
function acfo_common_form_user_register_form_alter(&$form, &$form_state, $form_id) {
  // Do special for user admins.
  if ($form['administer_users']['#value']) {
    // Default to sending user an account creation notification.
    $form['account']['notify']['#default_value'] = 1;

    // We'll send a one-time login link in lieu of setting a password here.
    $pass = user_password();
    $form['account']['pass']['#value'] = array(
      'pass1' => $pass,
      'pass2' => $pass,
    $form['account']['pass']['#access'] = FALSE;
  • Thanks I have updated my answer (and given you credit!). It turns out that I already had the working code on my server but must have accidentally copied an older version into the answer, sorry. – AdamS Feb 20 '16 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.