Why is char[] preferred over String for passwords in Java ?

Strings are immutable in nature which means it cannot be altered once they have been created. Moreover, strings are stored in the heap memory or String pool and remains in memory for a long duration, which poses a security threat. Whereas char[] are mutable in nature which means its content can be erased or modified once its purpose is served. When it's done being used it is cleaned and no one could ever know about the information you had stored. So, for security reasons char[] preferred over String for passwords in Java

3 years ago

While other suggestions here seem valid, there is one other good reason. With plain String you have much higher chances of accidentally printing the password to logs, monitors or some other insecure place. char[] is less vulnerable.

Consider this:

public static void main(String[] args) {

    Object pw = "Password";

    System.out.println("String: " + pw);



    pw = "Password".toCharArray();

    System.out.println("Array: " + pw);

}

Prints:

String: Password

Array: [C@5829428e

3 years ago