Not sure what is the reason behind it. I would suggest to use regular password field and required email field to confirm so they can recover account via email, or no need confirm email since it is visible to user.
Of course you cant have both nice UX and good security, seem like you pick UX more than security.