public void clear() {
        this.username = null;
        this.host = null;
        this.rememberMe = false;

        if (this.password != null) {
            for (int i = 0; i < password.length; i++) {
                this.password[i] = 0x00;
            }
            this.password = null;
        }

    }
Clears out (nulls) the username, password, rememberMe, and inetAddress.  The password bytes are explicitly set to
<tt>0x00</tt> before nulling to eliminate the possibility of memory access at a later time.
core/src/main/java/org/apache/shiro/authc/UsernamePasswordToken.java