Instead of creating a user with a default password you should create the user with a random password and never send it to them. Then they can use the forgot password link on the login page to reset their password first before logging in.
Instead of creating a user with a default password you should create the user with a random password and never send it to them. Then they can use the forgot password link on the login page to reset their password first before logging in.