Alex Rivera | Logout

Why getText() in JPasswordField was deprecated?

Asked 2012-05-04T05:48:16.543
37

I never thought before, only I used the method getPassword that returning an array of characters and I had seen the getText method was deprecated. But now that I think, why this method was deprecated?.

The Java documentation explains:

Deprecated. As of Java 2 platform v1.2, replaced by getPassword.

Fetches a portion of the text represented by the component. Returns an empty string if length is 0.

For security reasons, this method is deprecated. Use the getPassword method instead.

But what are those security reasons? Any ideas about this?

Thank you in advance.

java swing jpasswordfield
Edit
Report

1 Answer

9

The reason for this is that if you ask for the password as a String rather than as a character array, this string containing the password is now going to float around in the Java runtime's memory for some unspecified amount of time. It may be conceivably read from there by a rogue Java component or external program.

By using a char array instead, you can verify the password and then scramble it immediately.

answered 2012-05-04T05:53:17.007

Your Answer