GetPassword Method (String)
Collapse the table of content
Expand the table of content

MembershipUser.GetPassword Method (String)


Gets the password for the membership user from the membership data store.

Namespace:   System.Web.Security
Assembly:  System.Web.ApplicationServices (in System.Web.ApplicationServices.dll)

public virtual string GetPassword(
	string passwordAnswer


Type: System.String

The password answer for the membership user.

Return Value

Type: System.String

The password for the membership user.

Exception Condition

This method is not available. This can occur if the application targets the .NET Framework 4 Client Profile. To prevent this exception, override the method, or change the application to target the full version of the .NET Framework.

GetPassword calls the MembershipProvider.GetPassword method of the membership provider referenced by the ProviderName property to retrieve the password for the membership user from the membership data store. If a password answer is required and an incorrect password answer is supplied, a MembershipPasswordException is thrown by the membership provider.

If EnablePasswordRetrieval is false, the membership provider will return an exception. If the provider supports passwords with a PasswordFormat of Hashed, you will be unable to retrieve the password for the membership user and should consider making use of the ResetPassword method when a user has forgotten his or her password.


A ConfigurationException will be thrown if enablePasswordRetrieval is set to true and passwordFormat is set to Hashed in the Web.config file for the ASP.NET application.

If RequiresQuestionAndAnswer is false, you can supply null for the answer parameter, or use the GetPassword overload that does not take any parameters.

The following code example calls the GetPassword method to retrieve the password for a specified user name if the correct password answer is supplied. The password is sent to the user's e-mail address.


Returning a password in clear text using e-mail is not recommended for sites that require a high level of security. For high-security sites, it is recommended that you return passwords using encryption, such as SSL.

System_CAPS_security Security Note

This example contains a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>
<%@ Import Namespace="System.Web.Mail" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
<script runat="server">

public void Page_Load(object sender, EventArgs args)
  if (!Membership.EnablePasswordRetrieval)

  Msg.Text = "";

  if (!IsPostBack)
    Msg.Text = "Please supply a username.";

public void VerifyUsername()
    MembershipUser u = Membership.GetUser(UsernameTextBox.Text, false);

    if (u == null)
      Msg.Text = "Username " + Server.HtmlEncode(UsernameTextBox.Text) + " not found. Please check the value and re-enter.";

      QuestionLabel.Text = "";
      QuestionLabel.Enabled = false;
      AnswerTextBox.Enabled = false;
      EmailPasswordButton.Enabled = false;
      QuestionLabel.Text = u.PasswordQuestion;
      QuestionLabel.Enabled = true;
      AnswerTextBox.Enabled = true;
      EmailPasswordButton.Enabled = true;

public void EmailPassword_OnClick(object sender, EventArgs args)
  MembershipUser u = Membership.GetUser(UsernameTextBox.Text, false);
  string password;

  if (u != null)
      password = u.GetPassword(AnswerTextBox.Text);
    catch (Exception e)
      Msg.Text = "An exception occurred retrieving your password: " + Server.HtmlEncode(e.Message);

    EmailPassword(u.Email, password);
    Msg.Text = "Password sent via e-mail.";
    Msg.Text = "Password Answer is not valid. Please check the value and try again.";

private void EmailPassword(string email, string password)
    MailMessage Message = new MailMessage();
    Message.To = email;
    Message.From = "administrator";
    Message.Subject = "Your Password";
    Message.Body = "Your password is: " + Server.HtmlEncode(password);

    SmtpMail.SmtpServer = "smarthost";
    Msg.Text = "An exception occurred sending your password. Please try again.";

<html xmlns="" >
<title>Sample: Retrieve Password</title>

<form id="form1" runat="server">
  <h3>Retrieve Password</h3>

  <asp:Label id="Msg" runat="server" ForeColor="maroon" /><br />

  Username: <asp:Textbox id="UsernameTextBox" Columns="30" runat="server" AutoPostBack="true" />
            <asp:RequiredFieldValidator id="UsernameRequiredValidator" runat="server"
                                        ControlToValidate="UsernameTextBox" ForeColor="red"
                                        Display="Static" ErrorMessage="Required" /><br />

  Password Question: <b><asp:Label id="QuestionLabel" runat="server" /></b><br />

  Answer: <asp:TextBox id="AnswerTextBox" Columns="60" runat="server" Enabled="false" />
          <asp:RequiredFieldValidator id="AnswerRequiredValidator" runat="server"
                                      ControlToValidate="AnswerTextBox" ForeColor="red"
                                      Display="Static" ErrorMessage="Required" Enabled="false" /><br />

  <asp:Button id="EmailPasswordButton" Text="Email My Password" 
              OnClick="EmailPassword_OnClick" runat="server" Enabled="false" />



.NET Framework
Available since 2.0
Return to top
© 2016 Microsoft