Show error messages when things go wrong
Use 6-digit alpha passwords

Yes, they're less secure when it comes to brute-forcing, but they should
still be fine and make it more likely that the password will be
communicated out-of-band, so they improve the overall operational
security.