How to zero out the password in the memory. Flutter keeps all inputs from the TextEditingController

Question

It seems TextEditingController keeps all plain input text including password in the memory.

I have tried many things so far

• controller.dispose()
• set the value null
• replace with other text
• zero out the memory of controller.text by using the FFI

The problem is that the input logs(plain text json format) remain in the memory.

https://github.com/flutter/flutter/issues/84708

This is a critical issue for me.

Please let me know how to zero out the password in the memory.

Thank you.

Answer 1

You cannot effectively zero memory in Dart. Memory in Dart is managed by the garbage collector, so you cannot control the lifetime of memory allocations nor prevent memory from being copied or moved. Furthermore, Dart Strings are immutable.

One way to mitigate it would be to use dart:ffi and to have all operations involving passwords go through, say, a C or C++ library where memory is not managed by the GC, but that still wouldn't completely help if you use Dart code to get the password from the user in the first place.