# Java char[] vs String for Password Storage Explained

> Use a char[] instead of String for passwords in Java to enable explicit memory clearing, avoid String Constant Pool exposure, and prevent accidental logging

**URL:** https://sentry.io/answers/char-vs-string-passwords/

---

## The Problem

If you are writing an application in Java Swing that requires handling passwords, you will notice that the [`JPasswordField`](https://docs.oracle.com/javase/17/docs/api/javax/swing/JPasswordField.html) component returns a `char` array when calling the [`getPassword()`](https://docs.oracle.com/javase/17/docs/api/javax/swing/JPasswordField.html#getPassword()) method. There are a number of reasons why a `char[]` is preferred over a [`String`](https://docs.oracle.com/javase/17/docs/api/java/lang/String.html) for handling passwords. Let's consider them.

## The Solution

The fundamental issue with using a string to store a password is the concept of immutability. A `String` object is immutable in Java (which you can read more about in the Sentry answer to [Is Java Pass-By-Reference or Pass-By-Value?](https://sentry.io/answers/java-pass-by-reference-or-value/)). Due to this characteristic, if you were to store a password as a string, this plain text will be accessible until Java's Garbage Collection clears the unused objects in memory. The immutability of strings means that the `String` value will not be erased or overwritten on new assignment (rather, a new string is created). With a `char[]`, because these are primitives types we are acting on, we could overwrite the array with any value, meaning we can avoid having sensitive data present in memory once we are done processing it.

Additionally, strings in Java are reserved in a special area in heap memory called the String Constant Pool. When a string is declared in your program, a `String` object reference is created in stack memory, and additionally, a `String` object with the string value is created in the heap. The intention of this is for string reusability, but a consequence is that there is a good chance that the string will remain in memory for a prolonged period of time. This is an even bigger security threat. 

Another aspect to consider is the risk of printing the password to a logging device. Storing a password as a string does create this possibility, as strings are easily appended to log writers or even the standard system output stream. Conversely, with an array, accidentally printing this to a log or output stream would print the location of the array in memory. 

#### Concluding Thoughts

Using a `char[]` is certainly a safer option than using a `String` for handling passwords in Java. It should be noted though, that even if you are using a `char[]`, you should still be hashing passwords for security. Consider the following [guide](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) from the Open Web Application Security Project on password storage. Lastly, it is always prudent to explicitly clear a password from memory as soon as it has been used for authentication. 

### Further Reading

- [Is Java Pass-By-Reference or Pass-By-Value?](https://sentry.io/answers/java-pass-by-reference-or-value/)

---

*Source: [sentry.io/answers/char-vs-string-passwords/](https://sentry.io/answers/char-vs-string-passwords/)*