The feedback from our clients is that it is not obvious when a password is not being accepted leading to frustration with OC set up: T
"The password reset page that gets sent through doesn't state that if the password you're trying to set up doesn't meet the very high criteria for password strength that the system requires, it won't accept it.
It doesn't say that the potential password is not accepted.
It only says that the password is very weak; no explanation. So you press reset and you assume that it's gone through ok, as similar passwords are accepted elsewhere".
I know the criteria are displayed but it seems it is not obvious to users when they have complied with the requirements or when the password is being rejected