Export (0) Print
Expand All
Expand Minimize

MembershipPasswordFormat Enumeration

Describes the encryption format for storing passwords for membership users.

Namespace:  System.Web.Security
Assembly:  System.Web.ApplicationServices (in System.Web.ApplicationServices.dll)

public enum class MembershipPasswordFormat

Member nameDescription
ClearPasswords are not encrypted.
EncryptedPasswords are encrypted using the encryption settings determined by the machineKey Element (ASP.NET Settings Schema) element configuration.
HashedPasswords are encrypted one-way using the SHA1 hashing algorithm.

You can specify a hashing algorithm different than the SHA1 algorithm using the hashAlgorithmType attribute.

The SqlMembershipProvider class supports different password storage formats enabling you to increase the security of your membership user logins. Clear passwords are stored in plain text, which improves the performance of password storage and retrieval but is less secure, as passwords are easily read if your data source is compromised. Encrypted passwords are encrypted when stored and can be decrypted for password comparison or password retrieval. This requires additional processing for password storage and retrieval, but is more secure as passwords are not easily determined if the data source is compromised. Hashed passwords are encrypted using a one-way salted hash when stored in the database. When a password is validated, it is combined with a salt value and then hashed. The result is compared with the value in the database for verification. Hashed passwords cannot be retrieved.

NoteNote

If you are not familiar with the membership features of ASP.NET, see Introduction to Membership before continuing. For a list of other topics related to membership, see Managing Users by Using Membership.

The following example shows the membership element in the system.web section of the Web.config file for an ASP.NET application. It specifies the application's SqlMembershipProvider instance and sets its password format to Hashed.

<membership defaultProvider="SqlProvider" 
  userIsOnlineTimeWindow="20" hashAlgorithmType="SHA1">
  <providers>
    <add name="SqlProvider"
      type="System.Web.Security.SqlMembershipProvider"
      connectionStringName="SqlServices"
      enablePasswordRetrieval="false"
      enablePasswordReset="true"
      requiresQuestionAndAnswer="true"
      passwordFormat="Hashed"
      applicationName="MyApplication" />
  </providers>
</membership>

.NET Framework

Supported in: 4.5.3, 4, 3.5, 3.0, 2.0

.NET Framework Client Profile

Supported in: 4

Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, Windows Vista SP2, Windows Server 2008 (Server Core Role not supported), Windows Server 2008 R2 (Server Core Role supported with SP1 or later; Itanium not supported)

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

Show:
© 2014 Microsoft