Assuming you keep your database properly secured, that shouldn't be a problem. Otherwise, you'll need a two-way encryption scheme, maybe a rotation cipher?

my $password = "foobar+";
my $salt = 11;
my $newpass = "";

sub encrypt {
    my $password = shift;
    my @letters = split '', $password;
    foreach my $letter (@letters) {
        my $value = ord($letter) + $salt;
        while ($value > 255) {
            $value -= 255;
        }
        $newpass .= chr($value);
    }
}

sub decrypt {
    my $password = shift;
    my @letters = split '', $password;
    foreach my $letter (@letters) {
        my $value = ord($letter) - $salt;
                while ($value < 0) {
                        $value += 255; 
            }
        $newpass .= chr($value);
    }
}
[download]

What I've always done is put in functionality for the user to receive a new random password via email. If they forget it, they just put in their email address and their login and password are sent. Sites implement this in any number of ways.

Enter email address only - Just sends out a new password to the email address.

Enter email address and answer question - When you create an account, you include a question and answer portion. For example, "What is your favorite color?" "Red." In order for the new password to be set, the user has to successfully answer the question. Most allow the user to pick their own question.

that seems to be the best idea, just email a new password to the email address, thanks alot!

One problem here is that if I don't like someone I can reset their password to a new one, by entering their email address and saying 'mail new password'. Sure, they'll get the new one as an email but its a bit of an inconvenience. Probably not a major issue, though.

Most password-protected web pages out there evidently store the passwords in clear text, since they are able to mail it to you if you lose it. Although convenient, this is not necessarily secure. I think the best thing would be what comatose suggested, have the system generate a new random password and send it to the user. That way you don't have to store clear-text passwords.

Heh. Unless you do on-the-fly brute forcing of the crypt'd password when a user requests to be email'd it. That would just about be feasible for crypt'd passwords.

(Mostly a joke).