code: @Sensitive
      public char[] getChars() {
          if (_password != null) {
              if (_password.length != 0) {
                  char[] result = new char[_password.length];
                  System.arraycopy(_password, 0, result, 0, _password.length);
                  return result;
              } else {
                  return _password; // Can safely return the empty array - caller
                  // can't change it!
              }
          } else {
              return null;
          }
      }
docs: Return the protected password (Note: it is then the job of the caller to
  prevent its copies reaching trace, ffdc or converting it to a string
  
  @return char[] The protected password