Resolved. Sign-up and password reset now consistently require and state at least 10 characters.

The fix is live: the website now requires at least 10 characters, like the server, and says so. If a password is too weak, the error now explains what is needed. We are keeping an eye on it for a while.

Cause found: the server requires at least 10 characters, but the website said "at least 8" and let 8 or 9 characters through. The fix is ready and will be rolled out shortly.

When signing up or resetting your password, passwords with 8 or 9 characters are first accepted and then rejected with an unclear error. We are looking into it.

Until then: use a password with at least 10 characters and it will work.