I'm managing a smaller project that uses Drupal 8.

The site allows for users to register for an account. There is a simple feature which sends the user a welcome email along with their 'login details' so that they can keep it for future reference.

I was told that it would be impossible to send out the actual password in that email and it would only be possible to send out some thing like: Password: Password chosen during signup.

This is due to Drupal encrypting its data and for some reason sending out a decrypted password in an auto-generated email would not work.

Any second opinions on this? How would you solve this?

  • 1
    Drupal doesn't encrypt passwords, but stores their hashes. That is different, as from an encrypted password it's possible to get the password, but from an hash is impossible to get back the password. – kiamlaluno Aug 5 at 11:30
  • 1
    It would be technically possible with a little bit of custom coding. You'd just need to hook into the user_register_form and add your own submit function. In the data passed to that submit function would be whatever the user had entered so it would be visible. Then you'd just need to manually send a email yourself. But if you wanted an opinion on if its a good idea I'd say no, there's a reason drupal doesn't email the passwords by default because its not good practice from a security perspective – Leigh Aug 5 at 12:06
  • Do not do this. – Kevin Aug 5 at 12:15
  • More useful would be to add some text explaining that passwords are not sent in emails to protect the security of the user, and telling them what to do if they forget theirs. – Alfred Armstrong Aug 5 at 13:07
  • It is pointless to send an email with the password set when the account is created, since in most of the cases users aren't allowed to set a password when the account is created; the password is set when the users follow the link sent in the first email they receive. If users forget their password, there is a link to reset the password, which doesn't require to remember the password. – kiamlaluno Aug 5 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.