Why Java’s String Class Is Declared final: Security, Performance, and Thread‑Safety Explained

In Java the String class is declared final to provide four key benefits: security, performance, thread‑safety, and consistency.

Performance

Strings are heavily used; creating many duplicate objects wastes memory and CPU. Java maintains a string pool that reuses identical literals. When a literal is encountered, the JVM checks the pool; if the value already exists, the new reference points to the same object, avoiding extra allocation.

String s1 = "abc";
String s2 = "abc";

Both s1 and s2 reference the same pooled object.

If a mutable string were used, changing one reference would affect the other, which is undesirable.

Security

Immutable strings cannot be altered after creation, which is crucial when strings are used in sensitive operations such as password handling or class loading. Because the value cannot be changed, malicious code cannot replace class‑name strings used by class loaders.

Thread safety

Immutable objects are inherently thread‑safe; multiple threads can share a String instance without synchronization, eliminating concurrency bugs.

Hash‑code caching

Since a String never changes, its hash code can be computed once and cached. Subsequent calls to hashCode() return the cached value, improving performance in hash‑based collections such as HashMap and HashSet.

Consistency

Marking String as final prevents subclassing, ensuring that its behavior remains consistent and cannot be altered by derived classes.