What’s the point of having passwords at all? If there’s a password reset mechanism they provide no additional security. Just send a one time login token to the email.

Having a password just increases the odds of a hack by the user accidentally exposing it.