Why must String be immutable, and what would break if it weren't?

Immutability is what makes String safe to share freely, cache via the pool, and use as a HashMap key with a stable hashCode.

If Strings were mutable, a value used as a map key or in a security check (a file path or class name) could be changed after validation — a serious time-of-check-to-time-of-use vulnerability — and the pool's sharing would let one holder corrupt another's data. Immutability also makes Strings inherently thread-safe with no synchronization.