I searched the forums an found that this has been noted before, but not resolved as the issue wasn’t clearly elaborated.
With signup-password plugin, if there is an error on any field validation, the passwords are set to blank.
This applies, even if the error is on the second screen (i.e. when setting the site name, if you put in uppercase you correctly get a validation error). In this case, the second screen is redisplayed with the error message and ‘secretly’ the passwords are reset to blank.
When the user corrects the error on the second part sign-up screen the blog gets created. The fact that the password was reset to blank, even though they were correctly provided on screen 1, a random password gets generated.
Obviously not what the user expected.
Looking forward to a fast fix on this one as this is happening lots.