..the user is required to change their password to something good after logging in with the temporary password.
Great, but in that case it is even less necessary to generate the new password using existing words. The only valid rationality for using passwords containing real-language words is that the user is more likely to remember them and less likely to write them down and stick them to his monitor or store them on his computer somewhere. Since your newly generated password is only used once (to allow the user to set his own pw), there is no need for him/her to remember it and it might as well be a jumble of random letters.
|