Why is it preferable to use char[] instead of String for storing passwords?

Hello everyone! I'm a beginner Java developer, and I have a question about security when working with passwords. I often see passwords stored in String in code, but recently I came across a recommendation to use char[]. I have a simple authentication class: ```java public class UserAuthenticator { private String password; public void setPassword(String pwd) { this.password = pwd; } public boolean authenticate(String input) { return password.equals(input); } } ``` Everything works, but a colleague said this is vulnerable. I don't quite understand what the problem is. After all, String is an immutable object — isn't that a plus for security? Or am I missing something? Please explain with examples why char[] is considered more secure.