Since Version 4.3, password is always "both"

I can replicate the same behavior though it’s not always happening. Sometimes indeed the %user_password% shortcut in email notifications is rendered as “both”, which is not the actual password and leads to a very confusing customer experience.

This never occurred prior to WP 4.3.

On my site it leaves empty.
I think, because of wordpress passwords are not emailed to users anymore sonce WP4.3, they are replaced with a link to create a new password.

So instead of %user_password% we need a keyword/shortcode for this link.