Click here to Skip to main content
15,909,091 members
Please Sign up or sign in to vote.
1.40/5 (3 votes)
See more:
Hi..
I have store an encrypted password using Hash method in database. Is that possible or a way to decrypt it?Because i have to send decrypted password to another TextBox..
C#
System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(strPassword, ConfigurationManager.AppSettings("HashMethod"))
Posted
Updated 24-Jul-12 20:15pm
v2

No.

Hashing is not an encryption function.
The big difference is: Encrytpion can be reversed. Hashing can't - that is the whole point of using a hashing algorithm for password storage.

You should never attempt to send a password anywhere - just compare hashes. If the password gets forgotten, reset it and store the new hash value.
 
Share this answer
 
Comments
Sergey Alexandrovich Kryukov 25-Jul-12 2:30am    
Sure, a 5. We answered at the same time, nearly...
--SA
Aaaa! Not again! I don't understand what's wrong with the authors of all such questions on the hash (or passwords).

The cryptographic hash function is not designed to be "decrypted"!

This is a one-way function. Reversing it (finding argument value by image) is infeasible. When a cryptographic hash function is used, such reversing (call it "decryption", does not matter) is never needed; just the opposite: it is required to make it infeasible.

Please see:
http://en.wikipedia.org/wiki/Cryptographic_hash_function[^].

If you need encryption and decryption, use encryption algorithms.

[EDIT #1]

Ah, this is related to passwords?! Please think thoroughly: why do you think "decryption" could ever be needed for authentication or any other password-related purpose? It is never needed, because you never need to store a password. The idea is so obvious: you store only the hash function of a password, calculate the same hash during authentication and compare hash with hash. Never a password with password. This way, only one person in the world knows her/his own password. It would be so bad in anyone else knew. Isn't that reasonable and simple?

[EDIT #2]

Please see also my recent answer: storing password value int sql server with secure way[^].

[EDIT #3]

As to the encryption algorithms, with .NET you have a decent choice:
http://msdn.microsoft.com/en-us/library/system.security.cryptography.asymmetricalgorithm[^],
http://msdn.microsoft.com/en-us/library/system.security.cryptography.symmetricalgorithm[^].

For passwords, I would still recommend cryptographic hash functions, as I already explained.

Wow,
—SA
 
Share this answer
 
v8
Well AFAIK, you cannot reverse the hashed string - the algorithm is designed so it's impossible.

If you are verifying the password that a user entered the usual technique is to hash it and then compare it to the hashed version in the database.

This is how you could verify a usered entered table
C#
SELECT password_field FROM mytable WHERE password_field=pwdencrypt(userEnteredValue)
 
Share this answer
 
Comments
Sergey Alexandrovich Kryukov 25-Jul-12 2:29am    
More accurate tern is "infeasible" -- please see my answer and referenced article. (I voted 4 this time.)
--SA

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900