Why Magento welcome email still send customer password in plain text ?

I think this is not safe at all. I know that I can replace the line <strong>Password</strong>: {{htmlescape var=$customer.password}} to not show the passwords

I thought, after 1.9, it won't show passwords any more, but accidentally I found the welcome email include the password in plain text .

I wonder whether my magento codes have Security problem, because I think the password should not been seen and shown in any methods.

1 Answer 1


Yes, it is true that the Welcome mail contains the password in plain text, but there are some who say that it is a bad practice and other not ! I let you read this answer with the advantages and disadvantages and the Magento Security Enhancements

In any case you can change it by making one of these two choices:

In app/locale/YOURLANGUAGE/template/email/account_new.html you find:

<strong>Password</strong>: {{htmlescape var=$customer.password}}

Choice 1: You can change this by changing this email template and either remove this line or replace it with something like:

The password you have chosen when creating this account.

Choice 2: You could also create a new email template in the Admin Panel via System > Email Templates and then set this new template in System > Configuration > Customers > Customer Configuration > Create New Account Options > Welcome Email


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.