This was an existing password I think I had imported.
I was entering a new API key for my antivirus and it is 380 characters in length.
I was getting a 500 error.
Played with PHP errors to see if I could get the offending module and give more feedback, but no luck.
Tried a shorter password like newpassword and everything worked fine.