Click here to Skip to main content
15,064,806 members
Articles / Programming Languages / C#
Posted 25 Apr 2011

Tagged as


115 bookmarked

Password Storage: How to do it.

Rate me:
Please Sign up or sign in to vote.
4.92/5 (93 votes)
29 Apr 2011CPOL2 min read
A lot of people are asking how to encrypt passwords, and I have answered "Don't do it" too many times. This Tip describes how to store a password in your database, and why.
Why do I reply "Don't do it!" when asked how to encrypt passwords? Simple: it is a major security risk! However, I am definitely not suggesting that you should store passwords in plain text. Instead, you should use a hashing function on them, and store the result. Why:

  1. Storing passwords in plain text is simple, but a major security risk. Anyone who can get access to your database (and that is probably a lot more people than you think) gets every-bodies user ID and password, for free. Since many people can't remember more than one password, this gives them access to any system your user connects to, in theory. Not a good idea!
  2. Storing encrypted passwords is also a major security risk! Think about it: encryption requires decryption before it is any use. Which means your program must have access to the encryption key used to encrypt the password in the first place, every time you need to check if the user has entered the password correctly. There is a very good chance that anybody who has access to your database also has access to the executable and data files of your program, so the encryption key is effectively kept with the data it "protects". Not a good idea!

Instead, there is a class of cryptographic functions called "one-way functions" or "hashing algorithms". These do not work like encryption: there is no way to take the output of a hashing algorithm and work back to the entered password. You cannot decrypt a hashed value. The most common of these are MD5 and SHA, but MD5 has been shown to be "broken" - under some circumstances, you can get a workable input from the output. As a result, it is no longer recommended for new applications.

In addition, it is a good idea to include the user name or ID (whichever is unique in your system) in with the password in the data to hash, because it means that two users with the same password do not generate the same hash. Otherwise, the easy way to hack passwords is just: Try "Password". Does my hash in the database match any other users? No. Ok, try "password". And so on.

So: to hold the password in your database, create a VARBINARY column, 20 bytes long, called "Password".

Then add the following code:
/// <summary>
/// If the two SHA1 hashes are the same, returns true.
/// Otherwise returns false.
/// </summary>
/// <param name="p1"></param>
/// <param name="p2"></param>
/// <returns></returns>
private static bool MatchSHA1(byte[] p1, byte[] p2)
    bool result = false;
    if (p1 != null && p2 != null)
        if (p1.Length == p2.Length)
            result = true;
            for (int i = 0; i < p1.Length; i++)
                if (p1[i] != p2[i])
                    result = false;
    return result;
/// <summary>
/// Returns the SHA1 hash of the combined userID and password.
/// </summary>
/// <param name="userID"></param>
/// <param name="password"></param>
/// <returns></returns>
private static byte[] GetSHA1(string userID, string password)
    SHA1CryptoServiceProvider sha = new SHA1CryptoServiceProvider();
    return sha.ComputeHash(System.Text.Encoding.ASCII.GetBytes(userID + password));

To test it:
private static void RunTest()
    string userId = "OriginalGriff";
    string password = "NotMyPassword";
    string enteredPassword = "NotMyPassword";
    string notPassword = "notMyPassword";
    byte[] hashedPassword = GetSHA1(userId, password);
    if (MatchSHA1(hashedPassword, GetSHA1(userId, enteredPassword)))
        Console.WriteLine("Log him in!");
        Console.WriteLine("Don't log him in!");
    if (MatchSHA1(hashedPassword, GetSHA1(userId, notPassword)))
        Console.WriteLine("Will not happen!");
        Console.WriteLine("Don't log him in!");

You should get the output:
Log him in!
Don't log him in!

All you have to do now is write the hashed value into your database, and read it out for comparison when you want to log the user in.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Wales Wales
Born at an early age, he grew older. At the same time, his hair grew longer, and was tied up behind his head.
Has problems spelling the word "the".
Invented the portable cat-flap.
Currently, has not died yet. Or has he?

Comments and Discussions

GeneralMy vote of 5 Pin
CPallini20-Apr-13 5:18
mveCPallini20-Apr-13 5:18 
GeneralMy vote of 4 Pin
Thomas Daniels29-Dec-12 0:04
mvaThomas Daniels29-Dec-12 0:04 
GeneralRe: My vote of 4 Pin
OriginalGriff29-Dec-12 0:20
mveOriginalGriff29-Dec-12 0:20 
SuggestionRe: My vote of 4 Pin
Thomas Daniels30-Dec-12 4:57
mvaThomas Daniels30-Dec-12 4:57 
SuggestionRe: My vote of 4 Pin
Thomas Daniels26-Mar-13 3:28
mvaThomas Daniels26-Mar-13 3:28 
GeneralMy vote of 5 Pin
sariqkhan18-Nov-12 5:46
Membersariqkhan18-Nov-12 5:46 
QuestionAlternative Pin
Mehdi Gholam22-Jul-12 0:04
mvaMehdi Gholam22-Jul-12 0:04 
SuggestionDon't recommend MD5 Pin
Sergey Alexandrovich Kryukov3-Mar-12 13:12
mvaSergey Alexandrovich Kryukov3-Mar-12 13:12 
GeneralRe: Don't recommend MD5 Pin
OriginalGriff3-Mar-12 22:18
mveOriginalGriff3-Mar-12 22:18 
GeneralRe: Don't recommend MD5 Pin
Sergey Alexandrovich Kryukov3-Mar-12 22:21
mvaSergey Alexandrovich Kryukov3-Mar-12 22:21 
GeneralRe: Don't recommend MD5 Pin
OriginalGriff3-Mar-12 22:49
mveOriginalGriff3-Mar-12 22:49 
GeneralMessage Closed Pin
21-Aug-12 8:52
MemberWebMaster21-Aug-12 8:52 
GeneralRe: Don't recommend MD5 Pin
OriginalGriff21-Aug-12 9:02
mveOriginalGriff21-Aug-12 9:02 
GeneralRe: you can't recover a password when using hash/trapdoor functi... Pin
barneyman29-Apr-11 19:02
Memberbarneyman29-Apr-11 19:02 
GeneralRe: you can't recover a password when using hash/trapdoor functi... Pin
Paul Conrad17-Aug-12 11:09
professionalPaul Conrad17-Aug-12 11:09 
GeneralRe: I had a horrible feeling you were going to say that! Pin
OriginalGriff25-Apr-11 19:54
mveOriginalGriff25-Apr-11 19:54 
GeneralRe: How do you transfer passwords? Should a client send a hash? ... Pin
peterchen2-May-11 22:15
Memberpeterchen2-May-11 22:15 
GeneralRe: This is perfect. If you could comes with a solution for pass... Pin
CodingLover27-Apr-11 23:31
MemberCodingLover27-Apr-11 23:31 
GeneralRe: When in doubt, go for an article I'd say. Things tend to gro... Pin
Luc Pattyn25-Apr-11 9:45
sitebuilderLuc Pattyn25-Apr-11 9:45 
GeneralReason for my vote of 5 Well done! Pin
Espen Harlinn5-Feb-12 9:08
mvaEspen Harlinn5-Feb-12 9:08 
GeneralReason for my vote of 5 good one Pin
S.P.Tiwari12-Dec-11 1:26
professionalS.P.Tiwari12-Dec-11 1:26 
GeneralReason for my vote of 5 Awesome stuff! I wish they would put... Pin
Slacker00723-Jun-11 23:58
professionalSlacker00723-Jun-11 23:58 
GeneralIt's good that you mention hashing with the user id since it... Pin
Patrick Persson9-May-11 14:04
MemberPatrick Persson9-May-11 14:04 
GeneralHmmm, but isn't it that Sony stored passwords hashed and cre... Pin
Ivan Ičin3-May-11 11:39
MemberIvan Ičin3-May-11 11:39 
GeneralWhat if you're working within an API or other framework wher... Pin
kamahl3-May-11 5:01
Memberkamahl3-May-11 5:01 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.