This is why I always make sure to GC, delete or NULL input variables (you must include the request; body et al.) after encrypt/hash/<mechanism>.

I basically take the stanze that I want as little to do with your real password as possible.