Thread by @mwaseemzakir

💡 How to store Password in Database

Three common practices that are used for passwords, but first two has some serious issues.

✔️ Plain text password
✔️ Hashed password
✔️ Hashed password with Salt
✔️What is Salt
✔️How to validated hash password

#dotnet

#csharp #dotnet

1️⃣ Plain Text Password
Saving password in plain text is the worst approach because it is open to everyone who has database access and an easy target for attackers. Its not recommended at all.

2️⃣ Hashed Password
Hashing the plain text password first and then saving it, it seems safe but it isn’t safe again, you can fall for attack in this case as well rainbow attack.

3️⃣ Hashed Password with Salt
Last option is hash of salt and plain password. This would be a suitable password.

✔️ What is Salt
Salt is a unique and random string that we append with each password to make it safe. In C# we can simply use 𝐆𝐔𝐈𝐃 to get a unique string

✔️How hash password with salt is validated?

While saving password in database we store SALT as well

For login request we retrieve the SALT for the user and then combine it with the incoming password then hash it.

Compared it with hashed password saved in database and verify.

📧 If you like it , you might be interested in my weekly .NET Newsletter , Join family of 550+ Software Engineers here lnkd.in/dNHxJGRG