diff --git a/api/users/views.py b/api/users/views.py
index 9dc9f9475b3..1ace6e87813 100644
--- a/api/users/views.py
+++ b/api/users/views.py
@@ -1,3 +1,4 @@
+import uuid
 import pytz
 from urllib.parse import urlencode
 
@@ -781,7 +782,7 @@ def post(self, request, *args, **kwargs):
             accepted_terms_of_service = timezone.now() if accepted_terms_of_service else None
             user = OSFUser.create_unconfirmed(
                 username=clean_email,
-                password=None,
+                password=str(uuid.uuid4()),
                 fullname=fullname,
                 external_identity=external_identity,
                 campaign=None,
diff --git a/framework/auth/views.py b/framework/auth/views.py
index 870eec7c204..dbb4d3eecfb 100644
--- a/framework/auth/views.py
+++ b/framework/auth/views.py
@@ -1,3 +1,4 @@
+import uuid
 from furl import furl, urljoin
 from rest_framework import status as http_status
 from urllib.parse import urlencode
@@ -1128,7 +1129,7 @@ def external_login_email_post():
             accepted_terms_of_service = timezone.now() if form.accepted_terms_of_service.data else None
             user = OSFUser.create_unconfirmed(
                 username=clean_email,
-                password=None,
+                password=str(uuid.uuid4()),
                 fullname=fullname,
                 external_identity=external_identity,
                 campaign=None,
diff --git a/website/profile/views.py b/website/profile/views.py
index a08a586742e..c7740f98aa7 100644
--- a/website/profile/views.py
+++ b/website/profile/views.py
@@ -1,3 +1,4 @@
+import uuid
 import logging
 from rest_framework import status as http_status
 
@@ -438,6 +439,8 @@ def delete_external_identity(auth, **kwargs):
             auth.user.external_identity[service].pop(identity)
             if len(auth.user.external_identity[service]) == 0:
                 auth.user.external_identity.pop(service)
+            if not auth.user.has_usable_password():
+                auth.user.set_password(str(uuid.uuid4()))
             auth.user.save()
             return