diff --git a/modules/user/user.admin.inc b/modules/user/user.admin.inc
index 26cd9dec59e..84abde5ed93 100644
--- a/modules/user/user.admin.inc
+++ b/modules/user/user.admin.inc
@@ -422,7 +422,7 @@ function user_admin_settings() {
   );
   // These email tokens are shared for all settings, so just define
   // the list once to help ensure they stay in sync.
-  $email_token_help = t('You can use the following tokens in your e-mail message text: !site-name-token, !site-url-token, !user-name-token, !user-mail-token, !site-login-url-token, !user-edit-url-token, !user-one-time-login-url-token, !user-cancel-url-token', array('!site-name-token' => '[site:name]', '!site-url-token' => '[site:url]', '!user-name-token' => '[user:name]', '!user-mail-token' => '[user:mail]', '!site-login-url-token' => '[site:login-url]', '!user-edit-url-token' => '[user:edit-url]', '!user-one-time-login-url-token' => '[user:one-time-login-url]', '!user-cancel-url-token' => '[user:cancel-url]'));
+  $email_token_help = t('Available variables are: [site:name], [site:url], [user:name], [user:mail], [site:login-url], [site:url-brief], [user:edit-url], [user:one-time-login-url], [user:cancel-url].');
 
   $form['email_admin_created'] = array(
     '#type' => 'fieldset',
diff --git a/modules/user/user.install b/modules/user/user.install
index cd69c4c6c6f..ca7514137b5 100644
--- a/modules/user/user.install
+++ b/modules/user/user.install
@@ -670,6 +670,50 @@ function user_update_7010() {
     ->execute();
 }
 
+
+/**
+ * Updates email templates to use new tokens.
+ *
+ * This function upgrades customized email templates from the old !token format
+ * to the new core tokens format. Additionally, in Drupal 7 we no longer e-mail
+ * plain text passwords to users, and there is no token for a plain text
+ * password in the new token system. Therefore, it also modifies any saved
+ * templates using the old '!password' token such that the token is removed, and
+ * displays a warning to users that they may need to go and modify the wording
+ * of their templates.
+ */
+function user_update_7010() {
+  $message = '';
+
+  $tokens = array(
+    '!site-name-token' => '[site:name]',
+    '!site-url-token' => '[site:url]',
+    '!user-name-token' => '[user:name]',
+    '!user-mail-token' => '[user:mail]',
+    '!site-login-url-token' => '[site:login-url]',
+    '!site-url-brief-token' => '[site:url-brief]',
+    '!user-edit-url-token' => '[user:edit-url]',
+    '!user-one-time-login-url-token' => '[user:one-time-login-url]',
+    '!user-cancel-url-token' => '[user:cancel-url]',
+    '!password' => '',
+  );
+
+  $result = db_select('variable', 'v')
+    ->fields('v', array('name', 'value'))
+    ->condition('value', db_like('user_mail_') . '%', 'LIKE')
+    ->execute();
+
+  foreach ($result as $row) {
+    if (empty($message) && (strpos($row->value, '!password') !== FALSE)) {
+      $message = t('The ability to send users their passwords in plain text has been removed in Drupal 7. Your existing email templates have been modified to remove it. You should <a href="@template-url">review these templates</a> to make sure they read properly.', array('@template-url' => url('admin/config/people/accounts')));
+    }
+
+    variable_set($row->name, str_replace(array_keys($tokens), $tokens, $row->value));
+  }
+
+  return $message;
+}
+
 /**
  * @} End of "defgroup user-updates-6.x-to-7.x"
  * The next series of updates should start at 8000.
diff --git a/modules/user/user.module b/modules/user/user.module
index 132ec622cc3..bac1b767cd0 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -2416,141 +2416,141 @@ function _user_mail_text($key, $language = NULL, $variables = array(), $replace
     // No override, return default string.
     switch ($key) {
       case 'register_no_approval_required_subject':
-        $text = t('Account details for !user-name-token at !site-name-token', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account details for [user:name] at [site:name]', array(), array('langcode' => $langcode));
         break;
       case 'register_no_approval_required_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-Thank you for registering at !site-name-token. You may now log in by clicking this link or copying and pasting it to your browser:
+Thank you for registering at [site:name]. You may now log in by clicking this link or copying and pasting it to your browser:
 
-!one-time-login-token
+[user:one-time-login-url]
 
 This link can only be used once to log in and will lead you to a page where you can set your password.
 
-After setting your password, you will be able to log in at !site-login-url-token in the future using:
+After setting your password, you will be able to log in at [site:login-url] in the future using:
 
-username: !user-name-token
+username: [user:name]
 password: Your password
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]',  '!one-time-login-token' => '[user:one-time-login-url]', '!site-login-url-token' => '[site:login-url]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'register_admin_created_subject':
-        $text = t('An administrator created an account for you at !site-name-token', array('!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('An administrator created an account for you at [site:name]', array(), array('langcode' => $langcode));
         break;
       case 'register_admin_created_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-A site administrator at !site-name-token has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:
+A site administrator at [site:name] has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:
 
-!one-time-login-token
+[user:one-time-login-url]
 
 This link can only be used once to log in and will lead you to a page where you can set your password.
 
-After setting your password, you will be able to log in at !site-login-url-token in the future using:
+After setting your password, you will be able to log in at [site:login-url] in the future using:
 
-username: !user-name-token
+username: [user:name]
 password: Your password
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]',  '!one-time-login-token' => '[user:one-time-login-url]', '!site-login-url-token' => '[site:login-url]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'register_pending_approval_subject':
       case 'register_pending_approval_admin_subject':
-        $text = t('Account details for !user-name-token at !site-name-token (pending admin approval)', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account details for [user:name] at [site:name] (pending admin approval)', array(), array('langcode' => $langcode));
         break;
       case 'register_pending_approval_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-Thank you for registering at !site-name-token. Your application for an account is currently pending approval. Once it has been approved, you will receive another e-mail containing information about how to log in, set your password, and other details.
+Thank you for registering at [site:name]. Your application for an account is currently pending approval. Once it has been approved, you will receive another e-mail containing information about how to log in, set your password, and other details.
 
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
       case 'register_pending_approval_admin_body':
-        $text = t("!user-name-token has applied for an account.
+        $text = t("[user:name] has applied for an account.
 
-!user-edit-url-token", array('!user-name-token' => '[user:name]', '!user-edit-url-token' => '[user:edit-url]'), array('langcode' => $langcode));
+[user:edit-url]", array(), array('langcode' => $langcode));
         break;
 
       case 'password_reset_subject':
-        $text = t('Replacement login information for !user-name-token at !site-name-token', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Replacement login information for [user:name] at [site:name]', array(), array('langcode' => $langcode));
         break;
       case 'password_reset_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-A request to reset the password for your account has been made at !site-name-token.
+A request to reset the password for your account has been made at [site:name].
 
 You may now log in by clicking this link or copying and pasting it to your browser:
 
-!one-time-login-token
+[user:one-time-login-url]
 
 This link can only be used once to log in and will lead you to a page where you can set your password. It expires after one day and nothing will happen if it's not used.
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]',  '!one-time-login-token' => '[user:one-time-login-url]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'status_activated_subject':
-        $text = t('Account details for !user-name-token at !site-name-token (approved)', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account details for [user:name] at [site:name] (approved)', array(), array('langcode' => $langcode));
         break;
       case 'status_activated_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-Your account at !site-name-token has been activated.
+Your account at [site:name] has been activated.
 
 You may now log in by clicking this link or copying and pasting it into your browser:
 
-!one-time-login-token
+[site:login-url]
 
 This link can only be used once to log in and will lead you to a page where you can set your password.
 
-After setting your password, you will be able to log in at !site-login-url-token in the future using:
+After setting your password, you will be able to log in at [site:login-url] in the future using:
 
-username: !user-name-token
+username: [user:name]
 password: Your password
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]',  '!site-login-url-token' => '[site:login-url]', '!one-time-login-token' => '[user:one-time-login-url]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'status_blocked_subject':
-        $text = t('Account details for !user-name-token at !site-name-token (blocked)', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account details for [user:name] at [site:name] (blocked)', array(), array('langcode' => $langcode));
         break;
       case 'status_blocked_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-Your account on !site-name-token has been blocked.
+Your account on [site:name] has been blocked.
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'cancel_confirm_subject':
-        $text = t('Account cancellation request for !user-name-token at !site-name-token', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account cancellation request for [user:name] at [site:name]', array(), array('langcode' => $langcode));
         break;
       case 'cancel_confirm_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-A request to cancel your account has been made at !site-name-token.
+A request to cancel your account has been made at [site:name].
 
-You may now cancel your account on !site-url-brief-token by clicking this link or copying and pasting it into your browser:
+You may now cancel your account on [site:url-brief] by clicking this link or copying and pasting it into your browser:
 
-!user-cancel-url-token
+[user:cancel-url]
 
 NOTE: The cancellation of your account is not reversible.
 
 This link expires in one day and nothing will happen if it is not used.
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]', '!site-url-brief-token' => '[site:url-brief]', '!user-cancel-url-token' => '[user:cancel-url]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
 
       case 'status_canceled_subject':
-        $text = t('Account details for !user-name-token at !site-name-token (canceled)', array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+        $text = t('Account details for [user:name] at [site:name] (canceled)', array(), array('langcode' => $langcode));
         break;
       case 'status_canceled_body':
-        $text = t("!user-name-token,
+        $text = t("[user:name],
 
-Your account on !site-name-token has been canceled.
+Your account on [site:name] has been canceled.
 
---  !site-name-token team", array('!user-name-token' => '[user:name]', '!site-name-token' => '[site:name]'), array('langcode' => $langcode));
+--  [site:name] team", array(), array('langcode' => $langcode));
         break;
     }
   }