# Why Use char[] Instead of String for Java Passwords

> Store passwords as char arrays instead of Java Strings because strings are immutable, stay in the string pool, and cannot be cleared from memory after use

**URL:** https://sentry.io/answers/why-is-char-preferred-over-string-for-passwords/

---

## The problem

According to the official [Java Cryptography Architecture](https://docs.oracle.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html#PBEEx), you should not use `String` to collect passwords. The guide instead recommends using `char[]` as an alternative to safely and securely store passwords. Below we consider the reasons why.

## The solution

While `String` may seem like the logical data type to store passwords, a few issues makes it unsuitable. For starters, strings in Java are immutable. This means that once created, `String` cannot be modified. This is for multiple reasons, including thread safety, class loading, and security. Once created, all strings are added to the string pool, a Java heap where all string literals are stored. These strings remain available in memory until garbage collection takes place. Since they cannot be overwritten, it means our passwords stay in memory, vulnerable to being read by attackers.

A character array, `char[]`, on the other hand, can easily be overwritten or zeroed out after use. It is actually used by core Java methods such as [`javax.swing.JPasswordField`](https://docs.oracle.com/javase/7/docs/api/javax/swing/JPasswordField.html) and [`javax.crypto.spec.PBEKeySpec`](https://docs.oracle.com/javase/8/docs/api/javax/crypto/spec/PBEKeySpec.html). Using `char[]` adds an extra layer of security as our passwords and other sensitive data are no longer held in memory any longer than they should be.

Another reason for not using the `String` data type for passwords is that our application can easily and accidentally log it. This could be logging to the console, a log file, or a remote logging server. This is a huge risk as the user's password will be logged in plain text and vulnerable in the case of a breach. This has occurred with industry leaders like [Twitter](https://www.cnet.com/tech/tech-industry/twitter-advises-all-users-to-change-passwords-after-glitch-that-exposed-some-in-plain-text/) and [GitHub](https://www.zdnet.com/article/github-says-bug-exposed-account-passwords/).

Storing passwords as a `char[]` helps prevent accidental logging. When a character array is logged, it prints out the object's memory location by default instead of the array's contents, whereas `String` prints out the string's contents. The following example shows this:

```java
public static void main(String[] args) {
    String password = "Password";
    char[] securePassword = password.toCharArray();
    System.out.println("String: " + password);
    System.out.println("Char array: " + securePassword);
}
```

The output is as follows:

```bash
String: Password
Char array: [C@568db2f2
```

It's important to note that the use of `char[]` for passwords is not a substitute for hashing or encryption of passwords, as it only increases security at the application level. Passwords should still be hashed for security purposes when being stored.

---

*Source: [sentry.io/answers/why-is-char-preferred-over-string-for-passwords/](https://sentry.io/answers/why-is-char-preferred-over-string-for-passwords/)*