Morning David,
so this falls into the category of "unlucky". In HTML world the combination &# has a special meaning, and so as the string flows through the system it basically gets removed, and because there's only one char after that, it's getting removed as well.
I'm going to fiddle a bit on my end to see if this case can be detected, but for now I recommend just generating another random password.
cheers
Bruce