In StandardPBEByteEncryptor#initialize great care is taken to clear the password char[] array.
On line 666 an instance of PBEKeySpec is created:
final PBEKeySpec pbeKeySpec = new PBEKeySpec(normalizedPassword);
Would it be a good idea to call PBEKeySpec#clearPassword() on this after the calls to factory#generateSecret has completed?