Yes brudgers, that was the kind of analysis which I am waying, it is probably a kind of moot point, because I think that for this one time usage of plaintext, s

Yes brudgers, that was the kind of analysis which I am waying, it is probably a kind of moot point, because I think that for this one time usage of plaintext, sending the users (who might have been inactive for 10 months and forgotten their password, a friendly reminder of it, outweights the potential fallout from a few users who are knowledgable enough to know that plaintext is bad. I was pretty shocked to be honest when I was told that this site used plain text. I didn't think anyone did that, but it is also a kind of blessing, since now we can merge the accounts exactly and keep the passwords. I just would hate for the new users to think that we store plain texts. Few options. 1) Transfer all the accounts from (old) site A to site B hash correctly then provide a one time URL that gets emailed and have them pick a new password immediately regardless. 2) Email them the plain text password and say here you go, but don't store plaintext. 3) Email something like this: Your password is knda*r (While trying to give some pseudo impression that you don't store the entire plaintext. 4) Transfer the accounts and don't tell them anything about their passwords, but point them to our forgotten password if they can't remember it.