Index: wp-admin/js/user-profile.js
===================================================================
--- wp-admin/js/user-profile.js	(revision 42372)
+++ wp-admin/js/user-profile.js	(working copy)
@@ -161,7 +161,7 @@
 		// hide this
 		$('.user-pass2-wrap').hide();
 
-		$submitButton = $( '#submit, #wp-submit' ).on( 'click', function () {
+		$submitButton = $( '#submit' ).on( 'click', function () {
 			updateLock = false;
 		});
 
@@ -205,28 +205,52 @@
 
 		bindToggleButton();
 
-		if ( $generateButton.length ) {
-			$passwordWrapper.hide();
-		}
+		$generateButton.on( 'click', function() {
+			if($generateButton.hasClass( 'open' ) ) {
+				$generateButton.removeClass( 'open' );
+				// Clear any entered password.
+				$pass1Text.val( '' );
 
-		$generateButton.show();
-		$generateButton.on( 'click', function () {
-			updateLock = true;
+				// Generate a new password.
+				wp.ajax.post( 'generate-password' )
+					.done( function( data ) {
+						$pass1.data( 'pw', data );
+					} );
 
-			$generateButton.hide();
-			$passwordWrapper.show();
+				$passwordWrapper.hide();
+				$generateButton.attr( 'aria-expanded', false );
 
-			// Enable the inputs when showing.
-			$pass1.attr( 'disabled', false );
-			$pass2.attr( 'disabled', false );
-			$pass1Text.attr( 'disabled', false );
+				$weakRow.hide( 0, function () {
+					$weakCheckbox.removeProp( 'checked' );
+				} );
 
-			if ( $pass1Text.val().length === 0 ) {
-				generatePassword();
+				// Disable the inputs when hiding to prevent autofill and submission.
+				$pass1.prop( 'disabled', true );
+				$pass2.prop( 'disabled', true );
+				$pass1Text.prop( 'disabled', true );
+
+				resetToggle();
+
+				if ( $pass1Row.closest( 'form' ).is( '#your-profile' ) ) {
+					// Clear password field to prevent update
+					$pass1.val( '' ).trigger( 'pwupdate' );
+					$submitButtons.prop( 'disabled', false );
+				}
+			} else {
+				$generateButton.addClass( 'open' );
+				$generateButton.attr( 'aria-expanded', true );
+				$passwordWrapper.show();
+
+				// Enable the inputs when showing.
+				$pass1.attr( 'disabled', false );
+				$pass2.attr( 'disabled', false );
+				$pass1Text.attr( 'disabled', false );
+
+				if ( $pass1Text.val().length === 0 ) {
+					generatePassword();
+				}
 			}
-
 			_.defer( function() {
-				$pass1Text.focus();
 				if ( ! _.isUndefined( $pass1Text[0].setSelectionRange ) ) {
 					$pass1Text[0].setSelectionRange( 0, 100 );
 				}
@@ -237,6 +261,8 @@
 		$cancelButton.on( 'click', function () {
 			updateLock = false;
 
+			$generateButton.removeClass( 'open' );
+
 			// Clear any entered password.
 			$pass1Text.val( '' );
 
@@ -246,7 +272,7 @@
 					$pass1.data( 'pw', data );
 				} );
 
-			$generateButton.show();
+			$generateButton.attr( 'aria-expanded', false ).focus();
 			$passwordWrapper.hide();
 
 			$weakRow.hide( 0, function () {
@@ -314,7 +340,7 @@
 
 		if ( passStrength.className ) {
 			$pass1.add( $pass1Text ).addClass( passStrength.className );
-			if ( $( passStrength ).is( '.short, .bad' ) ) {
+			if ( 'short' === passStrength.className || 'bad' === passStrength.className ) {
 				if ( ! $weakCheckbox.prop( 'checked' ) ) {
 					$submitButtons.prop( 'disabled', true );
 				}