Encrypting passwords I am using Android's keystore to generate a key which is protected by fingerprint authentication. This key can be used to encrypt any secrets. In my case, I want to encrypt a user password (which is needed to access the app contents. Usually that's a reasonably strong letter-number-special-characters password.). The encrypted password is stored in the app's preferences. While these preferences are not fully public, I don't consider them secure storage.

Assuming an attacker has access to the encrypted password, I would like to expose as little as possible about the password itself. One thing that comes to my mind is password length. From the length of the encrypted text, it can be seen if the password is more than 16 characters or not. (I could hide this by always appending random text to have a fixed length of text for passwords &lt; N characters, with N sufficiently high). 

Are there any more serious issues? Is there any best practice on how to encrypt user passwords?
Since you are talking about password-based encryption, the best practice is to use a slow password-based key derivation function to derive the encryption key and only store the salt (and parmeters used). You can verify the correctness of the password by using authenticated encryption, which you should most likely be doing in any case.

The password hash used could be scrypt, or I suppose argon2.

Since you are using this in a password manager -type situation, the encrypted data is passwords, which is fine. The above advice is only about the master password that is used to secure the database. That should not be stored in plaintext or encrypted form and even its hash does not need to be.