diff --git a/java/google/registry/ui/server/otesetup/ConsoleOteSetupAction.java b/java/google/registry/ui/server/otesetup/ConsoleOteSetupAction.java
index 6af97abf8..bd16b07f3 100644
--- a/java/google/registry/ui/server/otesetup/ConsoleOteSetupAction.java
+++ b/java/google/registry/ui/server/otesetup/ConsoleOteSetupAction.java
@@ -95,7 +95,7 @@ public final class ConsoleOteSetupAction implements Runnable {
   @Inject SendEmailUtils sendEmailUtils;
   @Inject @Config("logoFilename") String logoFilename;
   @Inject @Config("productName") String productName;
-  @Inject @Config("base64StringGenerator") StringGenerator passwordGenerator;
+  @Inject @Config("base58StringGenerator") StringGenerator passwordGenerator;
   @Inject @Parameter("clientId") Optional<String> clientId;
   @Inject @Parameter("email") Optional<String> email;
   @Inject @Parameter("password") Optional<String> optionalPassword;
@@ -163,14 +163,12 @@ public final class ConsoleOteSetupAction implements Runnable {
   }
 
   private void runPost(HashMap<String, Object> data) {
-    // This is intentionally outside of the "try/catch", since not having these fields means someone
-    // tried to "manually" POST to this page. No need to send out a "pretty" result in that case.
-    checkState(clientId.isPresent() && email.isPresent(), "Must supply clientId and email");
-
-    data.put("baseClientId", clientId.get());
-    data.put("contactEmail", email.get());
-
     try {
+      checkState(clientId.isPresent() && email.isPresent(), "Must supply clientId and email");
+
+      data.put("baseClientId", clientId.get());
+      data.put("contactEmail", email.get());
+
       String password = optionalPassword.orElse(passwordGenerator.createString(PASSWORD_LENGTH));
       ImmutableMap<String, String> clientIdToTld =
           OteAccountBuilder.forClientId(clientId.get())
diff --git a/java/google/registry/ui/soy/Forms.soy b/java/google/registry/ui/soy/Forms.soy
index ae1199545..8779c4aef 100644
--- a/java/google/registry/ui/soy/Forms.soy
+++ b/java/google/registry/ui/soy/Forms.soy
@@ -107,6 +107,7 @@
 {template .inputFieldValue}
   {@param name: string}
   {@param? readonly: bool}
+  {@param? required: bool}
   {@param? value: ?}
   {@param? namePrefix: string}
   {@param? placeholder: string}
@@ -119,6 +120,7 @@
          {if isNonnull($placeholder) and not $readonly}
          placeholder="{$placeholder}"
          {/if}
+         {if $required}required{/if}
          {if $readonly}readonly{/if}>
 {/template}
 
@@ -128,6 +130,7 @@
   {@param label: string}
   {@param name: string}
   {@param? readonly: bool}
+  {@param? required: bool}
   {@param? namePrefix: string}
   {@param? value: ?}
   {@param? description: string}
diff --git a/java/google/registry/ui/soy/otesetup/Console.soy b/java/google/registry/ui/soy/otesetup/Console.soy
index 10a477e6d..3a1f41789 100644
--- a/java/google/registry/ui/soy/otesetup/Console.soy
+++ b/java/google/registry/ui/soy/otesetup/Console.soy
@@ -113,7 +113,7 @@
             {param name: 'clientId' /}
             {param value: $baseClientId /}
             {param placeholder: 'registrar\'s ID' /}
-            {param readonly: false /}
+            {param required: true /}
           {/call}
           <span class="{css('description')}">
             Must:
@@ -136,16 +136,22 @@
         {param description kind="text"}
           Will be granted web-console access to the OTE registrars.
         {/param}
-        {param readonly: false /}
+        {param required: true /}
       {/call}
+      <tr>
+        <td colspan="2">
+          <hr>
+          <h1>Optional fields</h1>
+          Don't fill unless you have a good reason to.
+        </td>
+      </tr>
       {call registry.soy.forms.inputFieldRowWithValue}
-        {param label: 'Password (optional)' /}
+        {param label: 'EPP password' /}
         {param name: 'password' /}
-        {param placeholder: 'Optional password' /}
+        {param placeholder: 'Optional' /}
         {param description kind="text"}
-          The password used to for EPP login. Leave blank to auto-generate a password.
+          The password used to for EPP login. Leave blank to auto-generate.
         {/param}
-        {param readonly: false /}
       {/call}
       {call registry.soy.forms.submitRow}
         {param label: 'create' /}