Java – how do I store passwords securely in memory when creating accounts?

Our web - based application uses the password specified during account creation to bind user accounts to users For Java, how to safely handle passwords before saving hash values in the database

More specifically, how to ensure that strings holding passwords are garbage collected in a sufficiently short time interval?

Solution

If you can (which can be difficult in Web Applications), it's better to store passwords in character arrays rather than in strings If you have finished storing passwords, you can use array Fill() overwrites it in memory and provides a reference to the garbage collector by discarding it:

Arrays.fill(password,' ');
password = null;

I just noticed that canceling the password would be a little paranoid, but if it reassures you, you can do:)