Four things from a pass over sign-up and sign-in.

• •The password requirements are stated up front, instead of appearing as a rejection after you have chosen one. There are no character rules — no "must contain a symbol". What we check is strength, plus whether the password appears in known breach data, and that is now what the form says.
• •A reveal toggle on every password field — all four of them, including the ones during a reset.
• •Choosing which Google account signs you in now works. We announced it on 5 August and it never reached Google: the setting was being sent under a name Google's API doesn't read, so the picker was skipped and whichever account you were already signed into was used. If you have a personal and a work Google account, you get the chooser.
• •Sign-in no longer reveals whether an email address has an account here. A wrong password and an unknown address get the same answer.