Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?

Answer

A system should not store the user's password in retrievable mode. This could be done adding salt (a meaningless string of letters and numbers, which doesn't change) and then hashing the whole string before saving to a persistent storage.

When the user signs into the system, the same route is taken to make sure that the password is correct. (password + salt) + hash = stored string.

Now this means that the system does not know the password, and therefore cannot send it to the user. Instead the user can receive a confirmation email where the user validates her email address. If the password is lost, we shouldn't send the password to the user. We should send a link to a unique page, valid only once, where the user can change the password, if the password were forgotten and requested by the user.

Please don't send passwords in email. Username is ok to send, though.