I am using Android's keystore to generate a key which is protected by fingerprint authentication. This key can be used to encrypt any secrets. In my case, I want to encrypt a user password (which is needed to access the app contents. Usually that's a reasonably strong letter-number-special-characters password.). The encrypted password is stored in the app's preferences. While these preferences are not fully public, I don't consider them secure storage.
Assuming an attacker has access to the encrypted password, I would like to expose as little as possible about the password itself. One thing that comes to my mind is password length. From the length of the encrypted text, it can be seen if the password is more than 16 characters or not. (I could hide this by always appending random text to have a fixed length of text for passwords < N characters, with N sufficiently high).
Are there any more serious issues? Is there any best practice on how to encrypt user passwords?