You should be sending a token and/or reset link which will allow the user to choose a new password.
This is much better than just sending a new password because:
* It can have a TTL.
* The user has to change it, they can't just keep using the plaintext one forever.
* You can perform some kind of verification, was the request for a new password sent from the same country/IP/device as the person generating a new password.
This is much better than just sending a new password because:
* It can have a TTL.
* The user has to change it, they can't just keep using the plaintext one forever.
* You can perform some kind of verification, was the request for a new password sent from the same country/IP/device as the person generating a new password.