---
title: >-
  Why character array is better than String for Storing password in Java? Example
updated: 2022-04-05 07:56:33Z
created: 2022-04-05 07:56:10Z
tags:
  - IT
  - Development/Java
source: >-
  https://javarevisited.blogspot.com/2012/03/why-character-array-is-better-than.html
---

## [Why character array is better than String for Storing password in Java? Example](https://javarevisited.blogspot.com/2012/03/why-character-array-is-better-than.html#axzz7PZJBp33O)

**Why character array is better than String for storing a password in Java** was a recent question asked to one of my friends in a java interview. he was interviewing for a Technical lead position and has over 6 years of experience. Both [Character array and String](http://javarevisited.blogspot.com/2012/02/how-to-convert-char-to-string-in-java.html) can be used to store text data but choosing one over the other is a difficult question if you haven't faced the situation already. But as my friend said any question related to String must have a clue on a special property of Strings like immutability and he used that to convince the interviewer. here we will explore some reasons why should you use char\[\] for storing passwords than String.

This article is in continuation of my earlier interview question post on String e.g. [Why String is immutable in Java](http://javarevisited.blogspot.com/2010/10/why-string-is-immutable-in-java.html) or [How Substring can cause a memory leak in Java](http://javarevisited.blogspot.com/2011/10/how-substring-in-java-works.html) if you haven't read those you may find them interesting.
Here are a few reasons which make sense to believe that character array is a better choice for storing the password in Java than String:

1) Since **Strings are immutable in Java** if you store the password as plain text it will be available in memory until the Garbage collector clears it and since String is used in the String pool for reusability there is a pretty high chance that it will remain in memory for a long duration, which poses a security threat.
Since anyone who has access to memory dump can find the password in clear text and that's another reason you should always use an encrypted password than plain text. Since Strings are immutable there is no way the contents of Strings can be changed because [any change will produce new String](http://javarevisited.blogspot.com/2011/07/string-vs-stringbuffer-vs-stringbuilder.html), while if you char\[\] you can still set all his elements as blank or zero. So **Storing the password in a character array clearly mitigates security risk of stealing passwords**.

2) **Java itself recommends** using getPassword() method of JPasswordField which returns a char\[\] and deprecated  getText() method which returns password in clear text stating security reason. Its good to follow advice from Java team and adhering to a standard rather than going against it.

3) With String there is always a risk of printing plain text in a [log file or console](http://javarevisited.blogspot.com/2011/05/top-10-tips-on-logging-in-java.html) but if use [Array](http://javarevisited.blogspot.com/2012/01/anonymous-array-example-java-create.html) you won't print contents of the array instead its memory location gets printed. though not a real reason still makes sense.

```java
String strPassword="Unknown";
char[] charPassword= new char[]{'U','n','k','w','o','n'};
System.out.println("String password: " + strPassword);
System.out.println("Character password: " + charPassword);
```

```
String password: Unknown
Character password: \[C@110b053
```

That's all on *why character array is a better choice than String for storing passwords in Java*.  Though using char\[\] is not just enough you need to erase content to be more secure. I also suggest working with hash'd or [encrypted password](http://javarevisited.blogspot.com/2012/02/how-to-encode-decode-string-in-java.html) instead of plain text and clearing it from memory as soon as authentication is completed.
