java - Using BCrypt with a char[] -

around few hours ago, enquired on stack overflow methods on how convert char[] md5 hash. solution provided, thought insecure - outlined couple of people: generating md5 hash char[]

neil smithline recommended make use of bcrypt, unable use char[]'s.

the reason using char[] storing retrieved password login form because .getpassword() supports char[].

        char[] passwordchars = passwordinputfield.getpassword();         string hashed = bcrypt.hashpw(passwordchars, bcrypt.gensalt(12)); 

currently, trying use above code generate hash variable passwordcars of type char[], not supported bcrypt.haspw()

now reason why not using regular string because cannot cleared memory.

my question - possible somehow use char[]'s bcrypt?

thanks in advance!

both java impls of bcrypt found take string input. seem know, putting password string opens memory attack.

you can use pbkdf2 bcrypt. both considered top-notch. there pbkdf2 java code samples here , here. both allow passing char[] functions.

to answer implicit question comments, reason don't use md5 or hash fast. brute forcing passwords special hardware becomes possible them. bcrypt , pbkdf2 designed slow.

even if you're going use hash (which recommend against), must salt it. reversing unsalted password hashes trivial (see this tool).

the crackstation's reference on password storage general reference.