Password change issues

Your site is designed to not allow a user to paste the password into the second password box when creating or changing a password.  This is a horrible design.  Anyone with any brains is using a password manager, which allows very complex passwords, and relieves the user of the requirement to remember them.  Even if users switch to passphrases instead, they still have to have some way to manage those, since the average user has more than 120 online accounts to manage.  Good security practices demand that users not re-use passwords/passphrases.  Your design policy makes it harder for people to practice good security.  It does not make the system more secure.

If you care about your users, don’t make them type long, complex, software-generated passwords into the password box.