Why is char preferred over String for passwords?

Gareth D.

—March 15, 2024

The problem

According to the official Java Cryptography Architecture, you should not use String to collect passwords. The guide instead recommends using char[] as an alternative to safely and securely store passwords. Below we consider the reasons why.

The solution

While String may seem like the logical data type to store passwords, a few issues makes it unsuitable. For starters, strings in Java are immutable. This means that once created, String cannot be modified. This is for multiple reasons, including thread safety, class loading, and security. Once created, all strings are added to the string pool, a Java heap where all string literals are stored. These strings remain available in memory until garbage collection takes place. Since they cannot be overwritten, it means our passwords stay in memory, vulnerable to being read by attackers.

A character array, char[], on the other hand, can easily be overwritten or zeroed out after use. It is actually used by core Java methods such as javax.swing.JPasswordField and javax.crypto.spec.PBEKeySpec. Using char[] adds an extra layer of security as our passwords and other sensitive data are no longer held in memory any longer than they should be.

Another reason for not using the String data type for passwords is that our application can easily and accidentally log it. This could be logging to the console, a log file, or a remote logging server. This is a huge risk as the user’s password will be logged in plain text and vulnerable in the case of a breach. This has occurred with industry leaders like Twitter and GitHub.

Storing passwords as a char[] helps prevent accidental logging. When a character array is logged, it prints out the object’s memory location by default instead of the array’s contents, whereas String prints out the string’s contents. The following example shows this:

public static void main(String[] args) {
    String password = "Password";
    char[] securePassword = password.toCharArray();
    System.out.println("String: " + password);
    System.out.println("Char array: " + securePassword);
}

The output is as follows:

String: Password
Char array: [C@568db2f2

It’s important to note that the use of char[] for passwords is not a substitute for hashing or encryption of passwords, as it only increases security at the application level. Passwords should still be hashed for security purposes when being stored.