**No, the password should not even be in the email in the first place.** At my place of work, one tells the login ID to a user and requests the user **to call IT** to obtain a temporary password.

There are some other security considerations to think about. 

 1. If your company has the robust technology to support it, **passwords should be hashed using a strong algorithm.**

 2. **The email itself should be sent encrypted**. 

   Avoid using SSL and early version TLS as the encryption method as these   are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)

 3. **Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender.** 

    A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.

The above ensures that the email has not been tampered with in transit, such as through MITM. 

 3. You might consider masking the data when displayed for extra security.