Why is a `char[]` Preferred Over a String for Passwords?

Lewis D.

The Problem

If you are writing an application in Java Swing that requires handling passwords, you will notice that the JPasswordField component returns a char array when calling the getPassword() method. There are a number of reasons why a char[] is preferred over a String for handling passwords. Let’s consider them.

The Solution

The fundamental issue with using a string to store a password is the concept of immutability. A String object is immutable in Java (which you can read more about in the Sentry answer to Is Java Pass-By-Reference or Pass-By-Value?). Due to this characteristic, if you were to store a password as a string, this plain text will be accessible until Java’s Garbage Collection clears the unused objects in memory. The immutability of strings means that the String value will not be erased or overwritten on new assignment (rather, a new string is created). With a char[], because these are primitives types we are acting on, we could overwrite the array with any value, meaning we can avoid having sensitive data present in memory once we are done processing it.

Additionally, strings in Java are reserved in a special area in heap memory called the String Constant Pool. When a string is declared in your program, a String object reference is created in stack memory, and additionally, a String object with the string value is created in the heap. The intention of this is for string reusability, but a consequence is that there is a good chance that the string will remain in memory for a prolonged period of time. This is an even bigger security threat.

Another aspect to consider is the risk of printing the password to a logging device. Storing a password as a string does create this possibility, as strings are easily appended to log writers or even the standard system output stream. Conversely, with an array, accidentally printing this to a log or output stream would print the location of the array in memory.

Concluding Thoughts

Using a char[] is certainly a safer option than using a String for handling passwords in Java. It should be noted though, that even if you are using a char[], you should still be hashing passwords for security. Consider the following guide from the Open Web Application Security Project on password storage. Lastly, it is always prudent to explicitly clear a password from memory as soon as it has been used for authentication.

Further Reading

• Is Java Pass-By-Reference or Pass-By-Value?