diff --git a/poi/src/main/java/org/apache/poi/hssf/record/RecordFactoryInputStream.java b/poi/src/main/java/org/apache/poi/hssf/record/RecordFactoryInputStream.java
index a5cedea15d..0afa60c254 100644
--- a/poi/src/main/java/org/apache/poi/hssf/record/RecordFactoryInputStream.java
+++ b/poi/src/main/java/org/apache/poi/hssf/record/RecordFactoryInputStream.java
@@ -119,10 +119,8 @@ public final class RecordFactoryInputStream {
             return createDecryptingStream(original, pwdString);
         }
 
-        /**
-         * @since 6.0.0
-         */
-        public RecordInputStream createDecryptingStream(InputStream original, String password) {
+        // keep this private because with new API methods, we want to encourage use of char array for passwords
+        private RecordInputStream createDecryptingStream(InputStream original, String password) {
             if (password == null) {
                 password = Biff8EncryptionKey.getCurrentUserPassword();
                 if (password == null) {