Lets not reinvent the wheel and do what the standards do: prompting for password should not reveal password length.

For instance ssh does not reveal the password.