...
This code example fixes the above decryption problem, however it may inadvertently store the passwords as cleartext. This is because the pass arguments may not be cleared from memory by the Java garbage collector until much later. See "MSC10-J. Limit the lifetime of sensitive data", for more information.
...