 <p>In theory, you cannot protect anything in memory completely. Some group out there managed to read the memory contents 4 hours after the computer was turned off. Even without going to such lengths, a debugger and a breakpoint at just the right time will do the trick.</p> <p>Practically though, just don't hold the plaintext in memory for longer than absolutely necessary. A determined enough attacker will get to it, but oh well.</p>