When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
Resetting vs. re-sending forgotten passwords
security;passwords
You should never be in a position to send a user their password. All passwords should be stored in a hashed format, with a sufficiently good hash function that recovering the original password is computationally infeasible.As for password resets, it depends on the application. If it's a web application, send a time-limited, use-once password reset link and have the user give you a new password. If it's not a web application, it gets a little bit trickier.