The JFC Swing Tutorial: A Guide to Constructing GUIs (2nd Edition)

The JPasswordField ^[104] class, a subclass of JTextField , provides text fields specialized for password entry. (See Figure 40.) For security reasons, a password field doesn't show the characters the user types. Instead, the field displays another character such as an asterisk (*). As another security precaution, a password field stores its value as an array of characters , rather than as a string. Like an ordinary text field, a password field fires an action event when the user indicates that text entry is complete, such as by pressing the Enter key.

^[104] JPasswordField API documentation: http://java.sun.com/j2se/1.4.2/docs/api/javax/swing/JPasswordField.html.

passwordField = new JPasswordField(10); passwordField.setEchoChar('#'); passwordField.setActionCommand(OK); passwordField.addActionListener(this);

The argument passed into the JPasswordField constructor indicates the preferred size of the field ”at least 10 columns wide in this case. By default a password field displays an asterisk (*) for each character typed. The call to setEchoChar changes it to a pound sign (#). Finally, the code adds an action listener to the password field, which checks the value typed in by the user. Here's the implementation of the action listener's actionPerformed method:

public void actionPerformed(ActionEvent e) { String cmd = e.getActionCommand(); if (OK.equals(cmd)) { //Process the password. char[] input = passwordField.getPassword(); if (isPasswordCorrect(input)) { JOptionPane.showMessageDialog(controllingFrame, "Success! You typed the right password."); } else { JOptionPane.showMessageDialog(controllingFrame, "Invalid password. Try again.", "Error Message", JOptionPane.ERROR_MESSAGE); } //Zero out the possible password, for security. for (int i = 0; i < input.length; i++) { input[i] = 0; } passwordField.selectAll(); resetFocus(); } else ...//handle the Help button... }

Security Note:

Although the JPasswordField class inherits the getText method, you should use the getPassword method instead. Not only is getText less secure, but in the future it might return the visible string instead of the typed-in string. To further enhance security, once you are finished with the character array returned by getPassword , you should set each of its elements to zero. The preceding code snippet shows how to do this.

A program using a password field typically validates the password before completing any actions requiring the password. This program calls a private method, isPasswordCorrect , that compares the value returned by getPassword to a value stored in a character array. Here's its code:

private static boolean isPasswordCorrect(char[] input) { boolean isCorrect = true; char[] correctPassword = { 'b', 'u', 'g', 'a', 'b', 'o', 'o' }; if (input.length != correctPassword.length) { isCorrect = false; } else { for (int i = 0; i < input.length; i++) { if (input[i] != correctPassword[i]) { isCorrect = false; } } } //Zero out the password. for (int i = 0; i < correctPassword.length; i++) { correctPassword[i] = 0; } return isCorrect; }

The Password Field API

Table 55 lists the commonly used JPasswordField constructors and methods . For information on the API that password fields inherit, see How to Use Text Fields (page 423).

Table 55. Commonly Used JPasswordField Constructors and Methods

Examples That Use Password Fields

The following examples use password fields. Also see Examples That Use Text Fields (page 426) for examples that use the API that password fields inherit.