title: What is safer? Should I send an email with a URL that expires to users to reset their password or should I email a newly generated password?
body: <p>I was wondering what would be the safer option when users have forgotten their password</p>
  
  <ul>
  <li>Send a randomly generated new password to the email address (all email addresses in my database are confirmed to work).</li>
  </ul>
  
  <p>Or</p>
  
  <ul>
  <li>Send an email with a link that expires within a certain time frame where the user can reset their password.</li>
  </ul>
  
  <p>Aside from the fact the latter uses an extra table, what do you think is safer/better practice?</p>