How QCFUM Generates and Delivers Temporary Passwords

For Direct Create, QCFUM generates the new Joomla user’s password privately. The frontend manager does not choose or see that generated password.

QCFUM 2.0.4 uses Joomla’s password generator for an 18-character temporary password, sets the Joomla account to require a password reset, and can send that credential directly to the new user through the Profile’s welcome-email behavior.

Direct Create Password Flow

  1. The frontend manager submits Name, Email, optional Username, and a User Type Profile.
  2. QCFUM generates an 18-character password with Joomla UserHelper::genRandomPassword().
  3. The password is used only to create the Joomla account and, when welcome email is enabled, to render the private message to the new user.
  4. QCFUM sets Joomla requireReset so the user must change the generated password at first login.
  5. The frontend response reports that a private temporary password was generated; it does not reveal the password to the manager.

Welcome Email Is Controlled by the Profile

A User Type Profile has a welcome-email flag. When it is enabled, QCFUM sends the Direct Create welcome template to the new user and includes the temporary password and reset-required message. When it is disabled, QCFUM still generates the password and requires a reset, but it does not send that welcome message.

If a site disables the welcome message, make sure the organization has a deliberate Joomla account-recovery or administrator reset process. Do not copy generated credentials into staff notes, screenshots, or tracking fields.

Mail Delivery Is a Separate Dependency

Creating the Joomla account and delivering email are separate operations. Verify Joomla mail transport and the QCFUM email template before relying on Direct Create in production. A manager should confirm delivery with the recipient rather than expecting the generated password to appear in QCFUM’s frontend history.

Security Boundary

Public Invite Link and Join Code account setup differ: the recipient supplies their own password. The private generated-password behavior described here applies to Direct Create and other QCFUM workflows that intentionally generate a temporary password.

Community Discussion

Want to compare Joomla user-onboarding workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.