Leaking the length of your password is about as bad for security as leaking the fact that you have a password, or that you use sudo.
It narrows down the brute force domain by several orders of magnitude
It narrows down the brute force domain by several orders of magnitude