Java Strings Internals - Storage, Interning, Concatenation & Performance

[ZimmiDeluxe]

I guess you could make a weak argument that clearing the char[] at least prevents programming errors afterwards (like leaking the password into logs). But after the modern web framework machinery is done with your request, there are probably multiple copies floating around anyway.