At the very least, every site should clearly explain its password policy. e.g. you must have a letter, a number, no slashes, 8-40 characters, whatever.

As I write this, I am locked out of my 401(k) plan's website because it allows you to reset your password to an illegal string, which fails when you try to log back in. Crappy corporate UX boggles the mind.