Consider forcing the user to change password on first login or rethink the registration process to ask users to enter new password (separate issue?)