Why char[] is Better Than String for Passwords? A Code Guide

Introduction: Why is this question still relevant?

Imagine a situation: you are writing a login application. A user enters a password, and you need to verify it. It seems easiest to store it as a String. But experienced Java developers will tell you: "Never use String for passwords! Use char[]!". Why?

This question is one of the most popular on Stack Overflow (over 100,000 views). And it's not that String cannot store characters. The problem is deeper: it concerns security, memory management, and data leaks. In this article, we will break down why char[] for passwords is a security standard, and show with code examples how to correctly implement this practice in Java.

If you are just starting to learn Java or want to improve the security level of your applications, this article is for you.

Problem #1: String Immutability

The String class in Java is immutable. This means that after a String object is created, its value cannot be changed. Any operation that "changes" the string (for example, toUpperCase() or replace()) actually creates a new String object in memory.

Why is this bad for a password? Let's look at an example:

String password = "MySecret123";// ... use the password for verification ...// We are done working with the passwordpassword = null; // "clearing" the reference

Do you think you cleared the memory? No! The "MySecret123" object is still hanging in memory, in the so-called String Pool. The garbage collector (GC) will not delete it immediately. It will be stored there until the next garbage collection, or more precisely, until there are no more references to it. And even after password = null, the object itself may remain in memory for an indefinite time.

What if an attacker gets a heap dump of your application? They will be able to read the password in plain text. String immutability makes it impossible to immediately remove the password from memory.

Problem #2: String Pool and Password Leaks

Java optimizes string handling through the String Pool. When you create a string using a literal (e.g., "password"), it is placed in the pool. If another part of the program uses the same string, it simply references the existing object.

Now imagine your password is "admin123". This same password might be accidentally used somewhere else in the system (for example, in logs, in a file name, or in configuration). The string "admin123" lives in the pool forever (at least until the JVM terminates). This increases the attack surface.

// Code that can lead to a leakString password = "admin123";System.out.println("Password: " + password); // Password ends up in logs// Even if later password = null, the string "admin123" remains in logs and in the pool

With a char[] array, there is no such problem: you can explicitly overwrite each element of the array after use.

Solution: char[] Array and Manual Memory Management

The character array char[] is a mutable object. You can change its contents at any time. The main advantage: you can clear the array immediately after the password is no longer needed.

Here is what it looks like in practice:

import java.util.Arrays;

public class PasswordExample {    public static void main(String[] args) {        // Incorrect: String        String passwordString = "MySecret123";        // ... verification ...        passwordString = null; // Password may still be in memory                // Correct: char[]        char[] passwordChars = { 'M', 'y', 'S', 'e', 'c', 'r', 'e',