public void destroy() throws Exception {
        if (!destroyed) {
            synchronized (this) {
                destroyed = true;
                cipherService = null;
                ByteUtils.wipe(ciphertext);
                ciphertext = null;
                ByteUtils.wipe(key);
                key = null;
            }
        }
    }
A simple implementation that maintains cipher service, ciphertext and key for decrypting it later.
{@link #useBytes(ByteSourceUser)} guarantees the sensitive data in byte array will be erased at end of use.
crypto/cipher/src/main/java/org/apache/shiro/crypto/cipher/SimpleByteSourceBroker.java