title: Java equivalent of SecureString
body: <p>I'm looking for Java's equivalent of .NET's <a href="https://referencesource.microsoft.com/#mscorlib/system/security/securestring.cs" rel="noreferrer">SecureString.aspx</a>. Is there such implementation available in 2018?</p>
  
  <p><a href="https://github.com/OWASP/passfault/blob/master/core/src/main/java/org/owasp/passfault/impl/SecureString.java" rel="noreferrer">OWASP implementation</a> is not exactly the same because it's just a plain char array. While .NET equivalent provides <a href="https://stackoverflow.com/questions/26190938/is-securestring-ever-practical-in-a-c-sharp-application/26202992#26202992">additional features</a> such as the ability to get an instance from/to unmanaged memory and also encryption.</p>
  
  <p>I'm aware of common Java pattern to pass around passwords as <code>char[]</code> and do <code>Arrays.fill()</code> them with zeros after use. But it requires building a trivial utility class around <code>char[]</code> all the time.</p>