Plain Text Passwords In Email

What this check and mySites.guru tool looks at on your site

This check reads the Send Password setting in your site’s Users configuration (Global Configuration, Users tab). If it’s still enabled, Joomla emails a user’s actual password, in plain text, whenever an account is created or a password is reset by an administrator.

It only covers the account-creation and administrator-reset path. A user resetting their own forgotten password through the front-end “Forgot your password” link already goes through Joomla’s token-based reset flow regardless of this setting, since that flow has always worked by email link rather than by emailing the password itself. Send Password is specifically about the older behaviour that fires when someone else, an administrator, sets up the account or resets it on the user’s behalf.

A password with an indefinite shelf life

Email is not a secure channel. It typically travels unencrypted between mail servers, sits indefinitely in an inbox, gets forwarded, gets synced to a phone, and gets swept up in whatever backup system the mail provider runs. A password sent by email exists in plain text in every one of those places for as long as the email itself exists, which in practice is often forever. Anyone who later gets into that inbox, through a compromised email account, a shared family computer, or a former employee’s mailbox nobody thought to close, gets a working password for the site straight out of it, with no need to guess or reset anything.

The setting doesn’t just fire once, either. It applies every time an account is created through the backend user manager and every time an administrator resets someone’s password manually, so it’s not a one-off exposure from years ago, it’s a standing habit that keeps generating new plain-text copies of passwords for as long as the setting stays on. If the same person, entirely reasonably, reuses that password anywhere else, the email sitting in their inbox is a copy of a credential that now also protects whatever else they used it for.

This isn’t a theoretical concern mySites.guru invented. Joomla itself has recommended against sending passwords by email since version 3.8.8, released in 2018, and changed the default for new installs to match. Sites that were upgraded from an older version, rather than freshly installed, kept whatever the setting used to be, which is the main reason this still turns up on established sites years later: nobody revisited a setting that predates the recommendation, because nothing about the site’s day-to-day running would ever prompt them to look.

Picture the ordinary version of this rather than a dramatic one. An administrator creates a login for a new client contact so they can approve content changes. Send Password is on, so Joomla emails that contact their new password in plain text, and the email sits in their inbox afterwards exactly as sent. Eighteen months later that contact’s personal email account gets caught up in an unrelated breach, one that has nothing to do with your site at all. The attacker who gets into that inbox isn’t looking for your site specifically, they’re working through a stolen mailbox for anything useful, and an email with a subject line like “Your new account details” is exactly the kind of thing that gets read. Your site’s password was never the target. It was just sitting there, in plain text, in a place that eventually got compromised for entirely unrelated reasons.

Nobody’s password ever reaches an inbox

Send Password is disabled. A new user sets their own password, or uses a reset link that expires, and nobody’s actual password is ever written into an email. There’s no real trade-off here: this isn’t a convenience setting worth keeping for a good reason, it’s a default from an older, less careful era of Joomla that most established sites simply never got round to reviewing. Turning it off doesn’t remove any functionality; account creation and password resets work the same way, they just stop emailing the password itself.

How to fix it

1. Login to the Joomla administration, e.g. https://yoursite.com/administrator.
2. Go to System, then Global Configuration.
3. Open the Users tab.
4. Set Send Password to No.
5. Click the Save button.

This sits in the same Global Configuration screens as a couple of the other checks in this group. While you’re there, it’s worth also checking whether Multi-Factor Authentication is forced for your Super Users: both are quick, unambiguous wins for how account credentials are handled.

Once the setting is off, new accounts and password resets go through Joomla’s normal flow instead: the user receives an email with a link, follows it, and sets their own password directly. Nothing about how quickly a new user can get into the site changes, the only difference is that the password itself is chosen by the person who’s going to use it, and it never has to travel anywhere in the clear.

What mySites.guru does about it

mySites.guru checks every connected site for this setting and can disable Send Password across every connected site with one click.