public synchronized void useBytes(ByteSourceUser user) {
        if (destroyed || user == null) {
            return;
        }
        ByteSource byteSource = cipherService.decryptInternal(ciphertext, key);

        try (ByteSourceWrapper temp = ByteSourceWrapper.wrap(byteSource.getBytes())) {
            user.use(temp.getBytes());
        } catch (IOException e) {
            // ignore
        }

    }
A simple implementation that maintains cipher service, ciphertext and key for decrypting it later.
{@link #useBytes(ByteSourceUser)} guarantees the sensitive data in byte array will be erased at end of use.
crypto/cipher/src/main/java/org/apache/shiro/crypto/cipher/SimpleByteSourceBroker.java