Hi, when a participant saves a survey to finish it later he receives an email with an access url, his user name and password.

I recently had a complain from a customer who thought his password was saved not encrypted since it is was written in plain text in the email and in the url. Of course, afterwards I could ensure him that the PW is saved encrypted but a little damage was already done.

My suggestion: We should add a line to this email, something like this:
We saved your chosen password encrypted to ensure your security. For your convenience it is here shown in plain text. Please remember your password or save this email. Since it is saved encrypted we can not restore your password when you forget it.

This text is just a suggestion but I think you'll get the idea.

Or a different, more secure solution: We could send, instead of the plain text PW in the URL, a hash of the encrypted PW.
And in the meantime don't send the PW at all in the email text.

The URL could be enough and it is a more secure solution.

All the best, urban-a :)