It has become almost a habit for many developers to use System.String to store sensitive information such as passwords. The problem with this approach is that System.String is immutable. This means that the object created in memory by System.String can't be changed. If you modify the variable, a new object is created in memory. You also cannot determine when the object created by System.String will be removed from memory during garbage collection. Conversely, using the SecureString object, you will encrypt sensitive information and, when that object is no longer needed, it is deleted from memory. SecureString encrypts and decrypts your sensitive data in unmanaged memory.
Now, I need to be clear regarding one thing here.
