13
string newString = new string('*', oldString.Length);
Of course, it this is for displaying password equivalents, it might be better to use a fixed number of asterisks - the less clues the better. Of course, since you'd obviously be hashing the password (with salt) and storing just the hash, you couldn't know the actual length anyway ;-p