I stand corrected. I just checked my "change password" option on TDCT and it now allows 8-32 characters. A year ago, this wasn't possible for my TDCT account as I distinctly remember the difference between the US and Canadian online banking experiences. I should read the fine print more often.

Thanks for calling this out.