Encrypting Passwords

[Tayo]

How do I encrypt passwords before saving in the database

[Eliyahu Goldin]

Tayo,

The recommended way of storing passwords is hashing. Hashing works one way,
you can't calculate the actual password out of hash value. DotNet implements
hashing in function
System.Web.Security.FormsAuthentication.HashPasswo rdForStoringInConfigFile

You might want to use salt values for better security. Look at
http://www.microsoft.com/downloads/d...C-BF9C6593F25E
for the full explanation.

Eliyahu

"Tayo" <an*******@discussions.microsoft.com> wrote in message
news:E6**********************************@microsof t.com...

How do I encrypt passwords before saving in the database.

[Steve C. Orr [MVP, MCSD]]

Here's a concise article on hashing passwords:
http://www.aspnetpro.com/NewsletterA...200304so_l.asp

And here's some articles using other encryption techniques:
http://www.fawcette.com/vsm/2002_08/...us/default.asp
http://www.devx.com/security/article/7019

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
"Tayo" <an*******@discussions.microsoft.com> wrote in message
news:E6**********************************@microsof t.com...

How do I encrypt passwords before saving in the database.

[Nick Gilbert]

> The recommended way of storing passwords is hashing.

Don't forget that if you choose to store the password as a hash, you
will never be able to remind the user of their password (there is no way
to get the password out of the hash). Instead you will need to provide a
reset password feature which perhaps, changes the password to random
chars and e-mails it to them.

Nick...