Adopt best practice of always representing passwords as char[]s.