Why getText() in JPasswordField was deprecated?

java swing jpasswordfield
Paul Vargas picture Paul Vargas · May 4, 2012 · Viewed 61.2k times · Source

I never thought before, only I used the method getPassword that returning an array of characters and I had seen the getText method was deprecated. But now that I think, why this method was deprecated?.

The Java documentation explains:

Deprecated. As of Java 2 platform v1.2, replaced by getPassword.

Fetches a portion of the text represented by the component. Returns an empty string if length is 0.

For security reasons, this method is deprecated. Use the getPassword method instead.

But what are those security reasons? Any ideas about this?

Thank you in advance.

Answer

MByD picture MByD · May 4, 2012

When calling getText you get a String (immutable object) that may not be changed (except reflection) and so the password stays in the memory until garbage collected.

When calling getPassword you get a char array that may be modified, so the password will really not stay in memory.

Related questions

getText() vs getPassword()

I'm currently designing a login system for a make-believe company, right now all I have is the Main login, which needs a lot of cleaning up. Below is my login handler. private class LoginButtonHandler implements ActionListener { public void actionPerformed(ActionEvent …

Read More
Adding a password field - GUI

I have a JTextField. The same JTextField will be used to get both name and password of the user. So if it's getting the username, I would display what the user is typing on the Text field. But if he's …

Read More
How to check if JPassword field is null

I want to check the username and password in Swing. The check works for username, but it doesn't work for JPaswordfield. I am posting the related code: //Here I get the password Char[] pwd = jt1.getPassword(); String s = new String(…

Read More