Why are Strings immutable in Java?
String immutability in Java means that once a `String` object is created, its character sequence cannot be changed. Any operation that appears to modify a string — concatenation, `replace()`, `substring()` — actually creates and returns a new `String` object. The original remains unchanged.
There are four core reasons this design decision was made.
First, thread safety. Because strings cannot be mutated, they can be freely shared across threads without synchronization. No thread can corrupt another's view of the string.
Second, security. Strings are widely used for sensitive data — file paths, network hostnames, database URLs, class names for reflection. If strings were mutable, defensive code could pass a validated string to a security-sensitive API only to have it mutated by another thread before the API consumed it. Immutability closes that attack surface.
Third, hashCode caching. `String` caches its `hashCode` after the first computation. This is only safe because the content can never change. It makes strings highly efficient as `HashMap` keys — the hash is computed once and reused on every lookup.
Fourth, String Constant Pool participation. The JVM pools string literals and returns shared references for identical values. This optimization is only correct if strings cannot be mutated — otherwise modifying one reference would corrupt all others sharing the same pooled object.
The implementation enforces immutability by making the internal `char[]` (or `byte[]` in Java 9+ with compact strings) both `private` and `final`, and by never exposing a reference to it. Even though `final` on an array only freezes the reference, not the array contents, the array is never leaked.
A common interview follow-up: immutability does not mean the reference variable is constant. `String s = "a"; s = "b";` is valid — you are rebinding the variable, not mutating the object.
Names thread safety and security as motivations and explains that operations produce new objects.
Also explains hashCode caching, String Constant Pool safety, and the internal implementation detail of a private final char array.
Reading the answer is step one. Explaining it unprompted — under interview pressure — is what actually matters. Get AI-graded feedback on your answer with follow-up probes on your weak points.
Get Graded — Free Assessment