Don't send them a random password. Send them a one-time login link (which is kind of like a random password, but it's embedded in the URL so you don't need to type it in to anything). The first screen they see once they're in asks them to reset their password.

For my own projects I don't set any limits on passwords that people enter - if they want to use an insecure password that's their problem.