save encrypted pass word

Question

Hi I would like to add username and password from my user interface to my database table. There was already a old password in the data table. Here is the encrypted password: FC64474D0994379EA2FC8E8E320770EA58C3554B I would like to save my new password in the same encryption. How can i solve this issue? Thanks Darma

Vulpes · Answer

Assuming SHA-1 was used or you're happy to use it in future here's how you can encrypt a given password in the form of a hex string for storing in the database: using System; using System.Text; using System.Security.Cryptography; class Program { static void Main() { string password = New73Ok18; // or whatever byte[] pwBytes = Encoding.UTF8.GetBytes(password); byte[] hash = SHA1.Create().ComputeHash(pwBytes); // express byte array as hex string StringBuilder hex = new StringBuilder(); for(int i = 0; i Console.WriteLine(hex.ToString()); Console.ReadKey(); } } The output is: 9E8806971A97BDCDF87F5731DA938A9E18A68B54

Vulpes · Answer

Ken When a user attempts to sign in you first look for his/her user name in the database. If it's not there you inform the user that it's an invalid user name and/or password. If it is there you hash the password entered using SHA-1 and compare it with the hashed password in the user's record in the database. If they're the same then the user has successfully logged in. Otherwise you inform the user that it's an invalid user name and/or password. Simple but effective :)

Ken H · Answer

Thank for Vulpes.

darma teja · Answer

Hi Vulpes Wonderful it works. Thanks Darma

Ken H · Answer

So how to compare user-entered password with the database stored encrypted password?

Vulpes · Answer

I'm afraid you can't Ken. SHA-1 is basically a hashing algorithm which provides 'one way' encryption. It's therefore often used for passwords - you just compare the hash of the password entered with the one stored in the database - and you never actually know what the password is. However nowadays a 20 byte hash isn't considered 100% secure and if more security is needed you'd be better using SHA-256 (32 bytes) or stronger.

Ken H · Answer

hi Vulpes How to restore the original look encrypted characters. for example: 9E8806971A97BDCDF87F5731DA938A9E18A68B54 ==> New73Ok18 Thank you.

Vulpes · Answer

Do you know what type of encryption was used? If you don't then my guess is that it was SHA-1 because the encrypted password is 20 bytes long.