What is a temporary password?
A temporary (or one-time) password is a credential an administrator issues so that a user can sign in once — after an account is created or after a password reset — and immediately choose a permanent password. Because it travels through a help-desk call, an email, an SMS or a printed welcome letter, it has different requirements from a normal password:
- Readable. No characters that look alike (
0/O,1/l/I,5/S,2/Z,8/B). This tool enables Easy to read by default. - Easy to dictate. Symbols such as
^,~or`cause confusion on the phone, so they are off by default. - Still strong. 14 readable characters provide about 79 bits — plenty for a credential that is valid only for a short time.
Best practices for issuing temporary passwords
- Force a change at first login. In Microsoft Entra ID / Active Directory this is “User must change password at next logon”; Google Workspace calls it “Ask for a password change at the next sign-in”.
- Set an expiry. Hours or a few days, not weeks. Many identity providers support a separate expiry for temporary passwords.
- Use a different channel. Send the username by email and the temporary password by SMS or phone — never both in the same message.
- Generate a unique one each time. Never use a shared default such as
Welcome2026!; attackers spray exactly those passwords across all accounts. - Prefer reset links where possible. A time-limited magic link or passwordless sign-in removes the need to share a password at all.
Provisioning many users?
For batch onboarding — a new class of students or a new office — use the bulk password generator with the same settings to create one unique temporary password per user, then import the list into your directory.
Last updated: · Reviewed by the Password Generator team