I'd think this is OK but I'm not sure if another Option to just give feedback of keyboard activity would combine the best of both worlds.

A space with a cursor instead of an asterisk would make it harder to count the Chars

Adding a random 1 to 3 output chars instead of one would obfuscate this even more.

A delayed output could make you submit the password prompt before showing anything.

A single asterisk that switches back to space after 250ms inactivity may even be better.

I don't know, but somehow this feels underthought even if it probably is not. Simple is probably the best approach

Most of those suggestions would be incredible confusing for anyone not familiar with the concept.

Users expect to see exactly 1 new char (either the key pressed or an asterix) when they type something. Seeing up to three chars appearing or disappearing after some time imho is worse than what we have today.