You don't have to create a password for them 🙂 The safest is to create the user without password, and have them reset their password through email (you can even trigger that yourself if you want).
Not that through the web interface, when you reset the password, the server never learns the password!