When using WiFi i.e. 802.11 as the link layer, the frame headers aren't encrypted, revealing three MAC addresses (actually four, but the fourth is only used in ad-hoc mode). If you are more interested in the theory and how it looks like, you could read my more detailed answer to question "What does WPA2 traffic look like to a packet sniffer that is not connected to the network?"
This answers your first two questions:
From the MAC addresses it is possible to know the number of devices and mostly their manufacturers, too, as the first three octets are the organizationally unique identifier (OUI). The number of different MAC addresses will reveal the number of devices connected to the access point.
It is impossible to hide this information. While it is easy to spoof MAC address with computers, that does not work for all IoT devices. Also, spoofing and even changing the MAC address from time to time does not really hide the number of devices connected at a certain time. It can merely hide the vendor.
The last question depends on the encryption you are using. I assume you have properly protected your network with WPA2, and as a home user it is probably WPA2-PSK (pre-shared key), hopefully with AES (see e.g. Chris Hoffman: Wi-Fi Security: Should You Use WPA2-AES, WPA2-TKIP, or Both? for more details on why this matters).
- With WPA2-PSK, it is not possible to deduce the pre-shared key from the encrypted data. It does not matter whether someone sniffing your network does know the sites or not, as this information is within the encrypted payload.
However, it works the other way around. If an attacker can get your pre-shared key i.e. your "WiFi password", it will be possible to encrypt everything that has been captured from the network, given the capture contains the 4-way handshake. It is easy to deauthenticate a device, forcing a new 4-way handshake, so it is wise to always assume the attacker has it. It is also possible to try and brute-force the PSK against the captured traffic. For these reasons, you should use a long, random PSK and not keep it in a visible place.