Membership.EnablePasswordRetrieval Property


Gets a value indicating whether the current membership provider is configured to allow users to retrieve their passwords.

Namespace:   System.Web.Security
Assembly:  System.Web (in System.Web.dll)

public static bool EnablePasswordRetrieval { get; }

Property Value

Type: System.Boolean

true if the membership provider supports password retrieval; otherwise, false.

If EnablePasswordRetrieval is false, the underlying membership provider may throw a HttpException.

The providers that are included with the .NET Framework support multiple password formats to enhance password security. If the password format is set to Hashed, then users will not be able to retrieve their existing password from the database. The Hashed password format provides one-way encoding of password values. Passwords are "hashed" and compared to values stored in the database for authentication. "Hashed" values cannot be un-encoded to retrieve the original password value. For more information, see MembershipPasswordFormat.

The following code example shows the element in the system.web section of the Web.config file for an ASP.NET application. It specifies that the application use an instance of the SqlMembershipProvider and enables password retrieval.

<membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="20">
    <add name="SqlProvider"
      applicationName="MyApplication" />

The following code example first verifies that EnablePasswordRetrieval is true, then retrieves the password for a specified user name and sends it to the e-mail address for the specified user.

System_CAPS_security Security Note

Returning a password in clear text using e-mail is not recommended for sites that require a high level of security. For high-security sites, we recommend that you return passwords using encryption, such as SSL.

This example includes a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>
<%@ Import Namespace="System.Net.Mail" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
<script runat="server">

public void Page_Load(object sender, EventArgs args)
  if (!Membership.EnablePasswordRetrieval)

  Msg.Text = "";

  if (!IsPostBack)
    Msg.Text = "Please enter a user name.";

public void VerifyUsername()
    MembershipUser user = Membership.GetUser(UsernameTextBox.Text, false);

    if (user == null)
      Msg.Text = "The user name " + Server.HtmlEncode(UsernameTextBox.Text) + " was not found. Please check the value and re-enter.";

      QuestionLabel.Text = "";
      QuestionLabel.Enabled = false;
      AnswerTextBox.Enabled = false;
      EmailPasswordButton.Enabled = false;
      QuestionLabel.Text = user.PasswordQuestion;
      QuestionLabel.Enabled = true;
      AnswerTextBox.Enabled = true;
      EmailPasswordButton.Enabled = true;

public void EmailPassword_OnClick(object sender, EventArgs args)
  // Note: Returning a password in clear text using e-mail is not recommended for
  // sites that require a high level of security.

    string password = Membership.Provider.GetPassword(UsernameTextBox.Text, AnswerTextBox.Text);
    MembershipUser u = Membership.GetUser(UsernameTextBox.Text);
    EmailPassword(u.Email, password);
    Msg.Text = "Your password was sent via e-mail.";
  catch (MembershipPasswordException e)
    Msg.Text = "The password answer is incorrect. Please check the value and try again.";
  catch (System.Configuration.Provider.ProviderException e)
    Msg.Text = "An error occurred retrieving your password. Please check your values " +
               "and try again.";

private void EmailPassword(string email, string password)
    MailMessage Message = new MailMessage("administrator", email);
    Message.Subject = "Your Password";
    Message.Body = "Your password is: " + Server.HtmlEncode(password);

    SmtpClient SmtpMail = new SmtpClient("SMTPSERVER");
    Msg.Text = "An exception occurred while sending your password. Please try again.";

<html xmlns="" >
<title>Sample: Retrieve Password</title>

<form id="form1" runat="server">
  <h3>Retrieve Password</h3>

  <asp:Label id="Msg" runat="server" ForeColor="maroon" /><br />

  Username: <asp:Textbox id="UsernameTextBox" Columns="30" runat="server" AutoPostBack="true" />
            <asp:RequiredFieldValidator id="UsernameRequiredValidator" runat="server"
                                        ControlToValidate="UsernameTextBox" ForeColor="red"
                                        Display="Static" ErrorMessage="Required" /><br />

  Password Question: <b><asp:Label id="QuestionLabel" runat="server" /></b><br />

  Answer: <asp:TextBox id="AnswerTextBox" Columns="60" runat="server" Enabled="false" />
          <asp:RequiredFieldValidator id="AnswerRequiredValidator" runat="server"
                                      ControlToValidate="AnswerTextBox" ForeColor="red"
                                      Display="Static" ErrorMessage="Required" Enabled="false" /><br />

  <asp:Button id="EmailPasswordButton" Text="Email My Password" 
              OnClick="EmailPassword_OnClick" runat="server" Enabled="false" />



.NET Framework
Available since 2.0
Return to top