Adding a semi-random number of X after each character of a password is better than giving no output a la linux sudo (bad UX) or writing a single * (unsafe).

Not allowing pasting in the password prompt, then creating weird complex first-time passwords with Os and 0s is worse than both.