Index: wp-admin/includes/schema.php
===================================================================
--- wp-admin/includes/schema.php	(revision 43867)
+++ wp-admin/includes/schema.php	(working copy)
@@ -1188,7 +1188,7 @@
 		$site_admins = get_site_option( 'site_admins' );
 	}
 
-	/* translators: Do not translate USERNAME, SITE_NAME, BLOG_URL, PASSWORD: those are placeholders. */
+	/* translators: Do not translate USERNAME, SITE_NAME, BLOG_URL, PASSWORD, RESETLINK: those are placeholders. */
 	$welcome_email = __(
 		'Howdy USERNAME,
 
@@ -1198,7 +1198,7 @@
 You can log in to the administrator account with the following information:
 
 Username: USERNAME
-Password: PASSWORD
+To set your password, visit the following address: RESETLINK
 Log in here: BLOG_URLwp-login.php
 
 We hope you enjoy your new site. Thanks!
Index: wp-includes/ms-default-filters.php
===================================================================
--- wp-includes/ms-default-filters.php	(revision 43867)
+++ wp-includes/ms-default-filters.php	(working copy)
@@ -113,3 +113,8 @@
 
 // Whitelist multisite domains for HTTP requests
 add_filter( 'http_request_host_is_external', 'ms_allowed_http_request_hosts', 20, 2 );
+
+// Replace PASSWORD token in welcome_email and welcome_user_email for $password
+add_filter( 'wpmu_replace_password_token', 'wpmu_replace_password_token', 10, 2 );
+// Replace RESETLINK token in welcome_email and welcome_user_email for password reset url
+add_filter( 'wpmu_replace_resetlink_token', 'wpmu_replace_resetlink_token', 10, 2); 
Index: wp-includes/ms-functions.php
===================================================================
--- wp-includes/ms-functions.php	(revision 43867)
+++ wp-includes/ms-functions.php	(working copy)
@@ -1541,7 +1541,7 @@
 
 	$welcome_email = get_site_option( 'welcome_email' );
 	if ( $welcome_email == false ) {
-		/* translators: Do not translate USERNAME, SITE_NAME, BLOG_URL, PASSWORD: those are placeholders. */
+		/* translators: Do not translate USERNAME, SITE_NAME, BLOG_URL, PASSWORD, RESETLINK: those are placeholders. */
 		$welcome_email = __(
 			'Howdy USERNAME,
 
@@ -1551,7 +1551,8 @@
 You can log in to the administrator account with the following information:
 
 Username: USERNAME
-Password: PASSWORD
+To set your password, visit the following address: RESETLINK
+
 Log in here: BLOG_URLwp-login.php
 
 We hope you enjoy your new site. Thanks!
@@ -1566,9 +1567,10 @@
 	$welcome_email = str_replace( 'BLOG_TITLE', $title, $welcome_email );
 	$welcome_email = str_replace( 'BLOG_URL', $url, $welcome_email );
 	$welcome_email = str_replace( 'USERNAME', $user->user_login, $welcome_email );
-	$welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
-
-	/**
+	$welcome_email = apply_filters_deprecated( 'wpmu_replace_password_token', array($password, $welcome_email), '5.0', null, __("The PASSWORD token in 'Welcome Email' and 'Welcome User Email' New Site Settings (Network Settings) has been deprecated and will be removed in the future. Instead use RESETLINK as token") );
+	$welcome_email = apply_filters( 'wpmu_replace_resetlink_token', $user, $welcome_email );
+  
+  /**
 	 * Filters the content of the welcome email after site activation.
 	 *
 	 * Content should be formatted for transmission via wp_mail().
@@ -1617,6 +1619,40 @@
 	return true;
 }
 
+/** 
+ * Replace RESETLINK token with reset password url.
+ * 
+ * Filter {@see 'wpmu_replace_resetlink_token'} 
+ *
+ * @since 5.0.0
+ *
+ * @param $user User object
+ * @return string password reset link 
+ */
+function wpmu_replace_resetlink_token( $user, $text ) {
+  $user_login       = $user->user_login;
+  $set_password_key = get_password_reset_key( $user ); 
+  $reset_link       = network_site_url( "wp-login.php?action=rp&key=$set_password_key&login=" . rawurlencode( $user_login ), 'login' );
+	return str_replace( 'RESETLINK', $reset_link, $text ); 
+}
+
+/**
+ * Case-sensitive replace of PASSWORD token from $text with $password.
+ *
+ * Filter {@see 'wpmu_replace_password_token'} 
+ *
+ * @since 5.0.0.
+ *
+ * @param string $text 
+ * @param string $password
+ * @return string with PASSWORD replaced by $password 
+ *
+ */
+function wpmu_replace_password_token( $password, $text ) {
+	return str_replace( 'PASSWORD', $password, $text ); 
+}
+
+
 /**
  * Notify a user that their account activation has been successful.
  *
@@ -1671,10 +1707,11 @@
 	$welcome_email = apply_filters( 'update_welcome_user_email', $welcome_email, $user_id, $password, $meta );
 	$welcome_email = str_replace( 'SITE_NAME', $current_network->site_name, $welcome_email );
 	$welcome_email = str_replace( 'USERNAME', $user->user_login, $welcome_email );
-	$welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
+	$welcome_email = apply_filters_deprecated( 'wpmu_replace_password_token', array($password, $welcome_email), '5.0', null, __("The PASSWORD token in 'Welcome Email' and 'Welcome User Email' New Site Settings (Network Settings) has been deprecated and will be removed in the future. Instead use RESETLINK as token") );
 	$welcome_email = str_replace( 'LOGINLINK', wp_login_url(), $welcome_email );
-
-	$admin_email = get_site_option( 'admin_email' );
+	$welcome_email = apply_filters( 'wpmu_replace_resetlink_token', $user, $welcome_email );
+  
+  $admin_email = get_site_option( 'admin_email' );
 
 	if ( $admin_email == '' ) {
 		$admin_email = 'support@' . $_SERVER['SERVER_NAME'];
@@ -2272,7 +2309,7 @@
 	if ( ! $text ) {
 		remove_filter( 'site_option_welcome_user_email', 'welcome_user_msg_filter' );
 
-		/* translators: Do not translate USERNAME, PASSWORD, LOGINLINK, SITE_NAME: those are placeholders. */
+		/* translators: Do not translate USERNAME, PASSWORD, RESETLINK, LOGINLINK, SITE_NAME: those are placeholders. */
 		$text = __(
 			'Howdy USERNAME,
 
@@ -2280,7 +2317,7 @@
 
 You can log in with the following information:
 Username: USERNAME
-Password: PASSWORD
+Set your password: RESETLINK
 LOGINLINK
 
 Thanks!