Why Char array is favored over String for the storage of passwords?

The string is permanent in Java and put away in String pool. When it has made it remains in the pool until except if rubbish gathered. So despite the fact that we are finished with the secret key it's accessible in memory for a longer span and there is no real way to evade it. It is a security chance since anybody approaching memory dump can discover the secret word as clear content. In the event that we utilize a burn cluster to store secret phrase, we can set it to clear once we are finished with it.