getText() vs getPassword()

Question

I'm currently designing a login system for a make-believe company, right now all I have is the Main login, which needs a lot of cleaning up. Below is my login handler.

private class LoginButtonHandler implements ActionListener {
    public void actionPerformed(ActionEvent e) {
        if(_uid.getText().equalsIgnoreCase("Nathan") && _pwd.getText().equals("password")) {
            JOptionPane.showMessageDialog(null, "Congratulations on logging in!");
        } else {
          JOptionPane.showMessageDialog(null, "Error on login!");
        }
    }
}

As is, this works perfectly fine, but when I change it to

_pwd.getPassword.equals("password")

it directs straight to the else statement when everything is input correctly. What is wrong here? Full program below.

import javax.swing.*;
import java.awt.*;
import java.awt.event.*;

public class Main extends JFrame {
    private static final int HEIGHT = 90;
    private static final int WIDTH = 400;

    JTextField _uid = new JTextField(10);
    JPasswordField _pwd = new JPasswordField(10);
    JButton _login = new JButton("Login");
    JButton _reset = new JButton("Reset");

    public Main() {
       super("Login - Durptech");
        Container pane = getContentPane();
        setLayout(new FlowLayout());

        add(new JLabel("User ID:"));
            add(_uid);
        add(new JLabel("Password:"));
            add(_pwd);

            add(_login);
                _login.addActionListener(new LoginButtonHandler());
            add(_reset);
                _reset.addActionListener(new ResetButtonHandler());

        /*if(_uid.getText().equals("") && _pwd.getText().equals("")) {
            _login.setEnabled(false);
        } else {
            _login.setEnabled(true);
        }*/

       setSize(WIDTH, HEIGHT);
       setResizable(false);
       setLocation(500, 300);
       setDefaultCloseOperation(EXIT_ON_CLOSE);
       setVisible(true);
    }

    private class ResetButtonHandler implements ActionListener {
        public void actionPerformed(ActionEvent e) {
            _uid.setText("");
            _pwd.setText("");
            _uid.requestFocusInWindow();
        }
    }

    private class LoginButtonHandler implements ActionListener {
        public void actionPerformed(ActionEvent e) {
            if(_uid.getText().equalsIgnoreCase("Nathan") && _pwd.getText().equals("password")) {
                JOptionPane.showMessageDialog(null, "Congratulations on logging in!");
            } else {
              JOptionPane.showMessageDialog(null, "Error on login!");
            }
        }
    }

    public static void main(String[] args) {
        new Main();
    }
}

Answer 1

You will want to get to know the API well, to make it your best friend. The key to solving this is to see what JPasswordField#getPassword() returns. Hint 1: it's not a String. Hint 2: you may want to solve this using the java.util.Arrays class methods.

The reason getPassword doesn't return a String is because of the way Java handles Strings -- it can store them in the String pool, allowing Strings to hang out in the program longer than you'd expect, and making the Strings potentially retrievable by malware -- something you don't want to have happen to a password. It's much safer to work with char arrays.

Incidentally, don't use JPasswords deprecated getText() method or change a char array to a String using the new String(char[]) constructor since as these both return a String, they are not secure.

Answer 2

JPasswordField.getPassword() returns a char [] instead of a String. This is done for the sake of security. You should compare the characters inside the array instead of seeing if the char [] .equals(a String);