Since this is private, and doesn't introduce anything the current password manager doesn't do, security LGTM.
I brought up two related topics earlier:
Not revealing the length of passwords
Opinions were pretty ambivalent about showing password length (from both privacy and security UX), so feel free to keep the old behaviour.
Since
your API makes it easy to track individual password access, It would be nice if you could work this in, but you don't need to make it block your release.
»Lucas