It would be enough to just show a single character (* or some other to distinguish) if there is something typed in and show no character after using backspace to delete the typed password.

It doesn't make sense to show the exact amount of characters. It just leaks the password length.