Why is char preferred over a string

Question

Why this is so. I am not able to find an appropriate solution. Please help!

Answer 1

Strings are immutable. That means once you've created the String, if another process can dump memory, there's no way you can get rid of the data before garbage collection kicks in.

With an array, you can explicitly wipe the data after you're done with it. You can overwrite the array with anything you like, and the password won't be present anywhere in the system, even before garbage collection.

So yes, this is a security concern - but even using char[] only reduces the window of opportunity for an attacker, and it's only for this specific type of attack.