protected Object getStoredPassword(AuthenticationInfo storedAccountInfo) {
        Object stored = storedAccountInfo != null ? storedAccountInfo.getCredentials() : null;
        //fix for https://issues.apache.org/jira/browse/SHIRO-363
        if (stored instanceof char[]) {
            stored = new String((char[]) stored);
        }
        return stored;
    }
A {@link CredentialsMatcher} that employs best-practices comparisons for hashed text passwords.
<p/>
This implementation delegates to an internal {@link PasswordService} to perform the actual password
comparison.  This class is essentially a bridge between the generic CredentialsMatcher interface and the
more specific {@code PasswordService} component.

@since 1.2
core/src/main/java/org/apache/shiro/authc/credential/PasswordMatcher.java