20

I want to send a reminder email to the users to log in to my website with their username and password. My mail script is ready with the login ID, but I don't know how to decrypt the user's password.

Can anyone tell me how should I get the password associated with a user account?

Improve this question

4 Answers 4

Reset to default
30

You cannot get the user's password from what Drupal saves in the database. Drupal doesn't encrypt the password and saves it in the database, but it saves in database the hash of the password, which is the value returned from a one-way function; this means that is not possible to calculate the value that originated the hash.
That is the reason why hashes are saved instead of the passwords: If somebody access the database used by a Drupal site, it is not possible to retrieve the passwords, and access that site as one of the users registered in that site. (It could still possible to find a word with the exact same hash; so far, collision attacks are shown possible in short time only with MD5.)

Drupal is able to send an email to reset a user's password, which is not what you are asking for, but it could be helpful if you want the users to reset their password after X months. In this case, you could be interested to the code used by _user_mail_notify().

  // By default, we always notify except for canceled and blocked.
  $default_notify = ($op != 'status_canceled' && $op != 'status_blocked');
  $notify = variable_get('user_mail_' . $op . '_notify', $default_notify);
  if ($notify) {
    $params['account'] = $account;
    $language = $language ? $language : user_preferred_language($account);
    $mail = drupal_mail('user', $op, $account->mail, $language, $params);
    if ($op == 'register_pending_approval') {
      // If a user registered requiring admin approval, notify the admin, too.
      // We use the site default language for this.
      drupal_mail('user', 'register_pending_approval_admin', variable_get('site_mail', ini_get('sendmail_from')), language_default(), $params);
    }
  }
Improve this answer
1
  • 4
    Yes, it's normal security practice for all multi-user systems. Drupal uses one time login urls for reseting password. It means that users don't get their raw passwords, but get special link to login and set new one. One time login url can be found in token [user:one-time-login-url].
    – kalabro
    Dec 29, 2011 at 10:00
15

Please! Don't do that!

Implementing a login system on a web application is easy. Implementing a secure login system on a web application is a totally different matter. There are many aspects and details to consider, and Drupal does a fine job of dealing with just about all of those aspects out of the box.

Adding the feature you ask for would greatly reduce the security of your application. If you can decrypt the passwords, you have just stripped your app of a very important security mesure.

Other answers explain workarounds, BetaRide's answer would do what you ask, but be aware I totally agree with his closing statement.

In a very general way, I would probably tackle this in more or less the following manner:

In a custom module

  1. Implement hook_cron, this would builds an array containing all emails that match the criteria of your choice.

  2. Loop through the array and send the emails via drupal_mail. Do look into the function _user_mail_notify() kiamlaluno linked to up above.

If user has never logged in, you may need to send a reset password mail (not sure here), possibly using a combination of drupal_mail and hook_mail_alter to customise either the registration or the reset password email to your taste.

Hope that helps, I know it is a bit sketchy as I have not implemented anything similar in my Drupal experience so far, I was just pumping out a few ideas on how one could notify users in a secure manner. There are many alternatives to having a plain-text password in the email.

Good-luck friend, cheers to you & happy new-year!

Improve this answer
1
  • 2
    The first sentence of this answer needs to be emphasized in 16pt bold type, and is perhaps one of the few places in which the blink tag might've been appropriate.
    – Omnifarious
    Mar 12, 2012 at 18:57
8

You can use the AES encryption module to get readable passwords.

However there are very good reasons why passwords are not readable in standard Drupal. IMHO using the built in one way pw-recovery links is much more secure.

Improve this answer
0

You can use Account Password Token Module to send password in mail

Experimental Project

This is a sandbox project, which contains experimental code for developer use only.

This small module provides user account password token for account E-mails settings. Site administrator allowed sending the password to user in bellow settings:-

  1. Welcome (new user created by administrator)
  2. Welcome (no approval required)
  3. Account activation
  4. Welcome (no approval required, password is set)
  5. Password recovery
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.