What does it mean that string is immutable in C#? What really happens in memory when you "modify" a string, and why did .NET make strings immutable?

1. The System.String object layout

[ header 8B ][ MethodTable* 8B ][ _stringLength int 4B ][ _firstChar char 2B ][ ...chars ][ '\0' ]

• Characters are stored inline in the object as UTF-16 code units — a string is one contiguous allocation, not a pointer to a separate buffer.
• The trailing '\0' exists so strings can be passed to native APIs (fixed (char* p = s)) without copying.
• Because length and data live in the object, the runtime allocates strings with a special fast path (FastAllocateString) and does not zero-initialise twice.
• Strings of more than ~42,500 characters (85,000 bytes) go on the Large Object Heap, which is collected only with Gen2 and is not compacted by default.

2. Immutability is enforced by the API, not by the hardware

The String class exposes no members that mutate. Internally, the runtime writes into a freshly allocated string before publishing it (e.g. inside Concat, string.Create), which is safe because nobody else holds a reference yet.

Unsafe code can mutate a string:

unsafe { fixed (char* p = s) p[0] = 'J'; }   // DON'T

This breaks everything that relies on immutability: if s was an interned literal, every use of that literal in the process changes; dictionary entries with that key become unreachable; cached hash codes go stale. MemoryMarshal.AsMemory/AsSpan tricks have the same danger. Treat it as undefined behaviour.

3. Which operations allocate and which don't

The runtime is smart about returning the same instance when nothing changes, which is only safe because strings are immutable.

4. Why += in a loop is quadratic

Iteration i copies the existing i × L characters plus L new ones. Total copies = L × (1 + 2 + ... + n) = L × n(n+1)/2 → O(n²). It also creates n intermediate strings that immediately become garbage. Note the C# compiler optimises a + b + c + d in a single expression into one string.Concat(a, b, c, d) call — the problem is specifically repeated concatenation across statements or loop iterations.

5. Interning and literal sharing

All string literals in an assembly are interned: two occurrences of "OK" refer to the same object, so ReferenceEquals("OK", "OK") is true. Strings created at run time (concatenation, ToString(), reading files) are not interned unless you call string.Intern. This sharing is safe only because no one can mutate the shared instance.

6. Strings in other runtimes

• Java and Python also use immutable strings, for the same reasons.
• C++ std::string is mutable with value semantics (copied on assignment), which avoids aliasing problems at the cost of copies.
• .NET offers mutable alternatives when you need them: StringBuilder, char[], Span<char>, and for UTF-8, byte[]/Span<byte> with Utf8Formatter and IUtf8SpanFormattable.

7. Strings and security-sensitive data

Because strings are immutable and garbage-collected, a password or secret stored in a string cannot be wiped from memory; copies may linger until the GC overwrites them and can appear in crash dumps. SecureString is not recommended for new development on .NET Core (it is not encrypted on non-Windows platforms). The practical guidance: minimise the lifetime of secrets, avoid logging them, use char[]/byte[] buffers you clear (CryptographicOperations.ZeroMemory) for highly sensitive data, and keep secrets in Key Vault rather than in long-lived strings.

Try it yourself

1. Print ReferenceEquals(s, t) before and after s += "x".
2. Benchmark += vs StringBuilder vs string.Join for 10, 1,000 and 100,000 items with [MemoryDiagnoser].
3. Call "abc".Trim() and "abc".ToUpperInvariant() on already-trimmed / already-upper input and check whether the same instance is returned.
4. Watch dotnet-counters loh-size while running a large += loop.

using System.Text;

namespace Strings;

public static class Immutability
{
    public static void Main()
    {
        string name = "  ada  ";
        name.Trim();                              // BUG: result discarded
        Console.WriteLine($"[{name}]");           // [  ada  ]
        name = name.Trim().ToUpperInvariant();    // new string assigned
        Console.WriteLine($"[{name}]");           // [ADA]

        // Two references, one object: changing one variable does not affect the other
        string a = "hello";
        string b = a;
        a += " world";
        Console.WriteLine(b);                     // hello

        // Equality compares contents
        string c = new string(['h', 'e', 'l', 'l', 'o']);
        Console.WriteLine(b == c);                        // True
        Console.WriteLine(object.ReferenceEquals(b, c));  // False

        // Build text efficiently
        var rows = Enumerable.Range(1, 5).Select(i => $"row{i}");
        Console.WriteLine(string.Join(",", rows));

        // string.Create: write characters once, before the string is visible
        string padded = string.Create(8, 42, static (span, value) =>
        {
            span.Fill('0');
            value.TryFormat(span[^2..], out _);
        });
        Console.WriteLine(padded);                // 00000042
    }

    // Stream large output instead of building a huge string
    public static async Task WriteCsvAsync(Stream output, IAsyncEnumerable<string[]> rows, CancellationToken ct)
    {
        await using var writer = new StreamWriter(output, new UTF8Encoding(false));
        await foreach (var row in rows.WithCancellation(ct))
        {
            await writer.WriteLineAsync(string.Join(',', row));
        }
    }
}