I would generally do a page refresh on signup/error, that would avoid this as I'd know something happened rather than clicking submit 10 times. But that style of web development is no longer cool, so...
- I would smooth scroll the user up to where the error box is.
- A red border around the input that failed.
In other words, if you didn’t already know it, this site is enforcing terrible security practice, and not trying to filter out known-bad passwords. (zxcvbn would laugh at you for trying that. Basically every site that deals with setting passwords should use it.)
The reason it’s terrible security practice is that literally most people will just capitalise the first letter, or add a one, or add an exclamation mark, so it adds roughly no security while making people use passwords that they can’t remember, so they store them insecurely, &c. Sure, people should use password managers and all that, but they don’t.
Ok, so I sign up, and now I have to confirm my email. But...it's not a link I can just click, it's a code. So I switch back to the postbag tab, log in again, and it asks me for the code. I switch to email tab, copy the code, switch back to the postbag tab, put in the code. All a bit obstuse, but ok whatever...I'm done, right?
Nope, now I have to log in again after my account is verified.
That said, this looks really interesting and I'm excited to try it out. Thanks for posting!