How can I hash passwords in C#?

How can I hash passwords in C#?

You can use the Rfc2898DeriveBytes class for hashing passwords in C#. It implements PBKDF2.

Can you show me a code example?

Sure! Here's a simple example:

using System;
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    public static string HashPassword(string password)
    {
        byte[] salt;
        new RNGCryptoServiceProvider().GetBytes(salt = new byte[16]);
        var pbkdf2 = new Rfc2898DeriveBytes(password, salt, 10000);
        byte[] hash = pbkdf2.GetBytes(20);
        byte[] hashBytes = new byte[36];
        Array.Copy(salt, 0, hashBytes, 0, 16);
        Array.Copy(hash, 0, hashBytes, 16, 20);
        return Convert.ToBase64String(hashBytes);
    }
}

What about verifying the password?

To verify a password, you need to extract the salt and hash from the stored password and then hash the input password with the same salt.

Can you provide a verification code example?

Certainly! Here's how you can verify a password:

public static bool VerifyPassword(string password, string storedHash)
{
    byte[] hashBytes = Convert.FromBase64String(storedHash);
    byte[] salt = new byte[16];
    Array.Copy(hashBytes, 0, salt, 0, 16);
    var pbkdf2 = new Rfc2898DeriveBytes(password, salt, 10000);
    byte[] hash = pbkdf2.GetBytes(20);
    for (int i = 0; i < 20; i++)
    {
        if (hashBytes[i + 16] != hash[i])
            return false;
    }
    return true;
}