Just setting a string to `null` or calling the GC will not help here. It might delete the reference to the value, but not the value itself. After GC, it may be overwritten, but there is no guarantee that it will happend anytime soon.

What you need instead is something aking to a [`SecureString`](https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8), that implements a `Dispose` method and some obfuscation. However, the security it provides is limited: 

> We don't recommend that you use the SecureString class for new development. For more information, see [SecureString shouldn't be used](https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md) on GitHub.
>
> SecureString is a string type that provides a measure of security. It tries to avoid storing potentially sensitive strings in process memory as plain text. (For limitations, however, see the [How secure is SecureString?](https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8#HowSecure) section.)

The problem here is that if there is sufficently advanced malware with sufficiently high priviliges on your system, no secrets are safe no matter what fancy C# types you wrap them in. So I am not sure this is a problem with a solution.

If you do use a secure string, think about how you get the value into and out of it. If it passes through an ordinary string, you have gained absolutely nothing.