Introduction
When building secure applications in ASP.NET Core or any .NET-based system, handling user passwords correctly is one of the most critical responsibilities. Storing plain-text passwords is a serious security risk and can lead to data breaches if your database is compromised.
To protect user credentials, developers use password hashing techniques. One of the most trusted and widely used approaches is bcrypt password hashing in .NET.
Bcrypt is designed specifically for securely hashing passwords, making it resistant to brute-force attacks and modern hardware-based cracking attempts.
In this guide, we will walk through how to implement secure password hashing using bcrypt in .NET step by step, along with practical examples and best practices used in real-world applications.
What is Password Hashing?
Password hashing is the process of converting a plain-text password into a fixed-length string using a cryptographic algorithm.
Key characteristics:
One-way transformation (cannot be reversed)
Same input produces same hash (with same salt)
Used to verify passwords without storing them
Example
Password:
mypassword123
Hashed Output:
$2a$11$e0NRo4l7... (truncated)
Instead of storing the original password, only the hash is stored in the database.
Why Use Bcrypt for Password Hashing in .NET?
Bcrypt is specifically designed for password security.
Key Benefits
Built-in salting mechanism
Adjustable work factor (cost)
Resistant to brute-force attacks
Widely adopted in production systems
Unlike simple hashing algorithms like SHA256, bcrypt is intentionally slow, which makes it more secure.
Step 1: Install Bcrypt Package in .NET
To use bcrypt in ASP.NET Core, install the library:
dotnet add package BCrypt.Net-Next
Explanation
Step 2: Hash a Password Before Storing
using BCrypt.Net;
string password = "MySecurePassword123";
string hashedPassword = BCrypt.Net.BCrypt.HashPassword(password);
Console.WriteLine(hashedPassword);
Explanation
HashPassword() automatically generates a salt
The result includes salt + hash combined
This hash is what you store in your database
Step 3: Store Hashed Password in Database
Example User Model:
public class User
{
public int Id { get; set; }
public string Email { get; set; }
public string PasswordHash { get; set; }
}
Explanation
Step 4: Verify Password During Login
string enteredPassword = "MySecurePassword123";
bool isValid = BCrypt.Net.BCrypt.Verify(enteredPassword, hashedPassword);
if (isValid)
{
Console.WriteLine("Login successful");
}
else
{
Console.WriteLine("Invalid credentials");
}
Explanation
Verify() compares entered password with stored hash
Internally extracts salt and re-hashes input
Returns true if passwords match
Step 5: Use Work Factor (Cost) for Security
string hashed = BCrypt.Net.BCrypt.HashPassword(password, workFactor: 12);
Explanation
This helps future-proof your application against faster hardware attacks.
Step 6: Implement in ASP.NET Core Service
public class PasswordService
{
public string HashPassword(string password)
{
return BCrypt.Net.BCrypt.HashPassword(password);
}
public bool VerifyPassword(string password, string hash)
{
return BCrypt.Net.BCrypt.Verify(password, hash);
}
}
Explanation
Step 7: Use in Controller (Registration & Login)
Registration
[HttpPost("register")]
public IActionResult Register(User user)
{
user.PasswordHash = _passwordService.HashPassword(user.PasswordHash);
// Save user to database
return Ok();
}
Login
[HttpPost("login")]
public IActionResult Login(string email, string password)
{
var user = GetUserFromDatabase(email);
if (user == null)
return Unauthorized();
bool isValid = _passwordService.VerifyPassword(password, user.PasswordHash);
if (!isValid)
return Unauthorized();
return Ok("Login successful");
}
Explanation
Hash password during registration
Verify password during login
Never compare plain-text passwords
Best Practices for Secure Password Handling
Always hash passwords before storing
Use strong work factor
Never log passwords
Use HTTPS for data transmission
Combine with authentication systems (JWT, Identity)
Common Mistakes to Avoid
Storing plain-text passwords
Using fast hashing algorithms like MD5 or SHA1
Reusing salts manually
Ignoring password security in APIs
Real-World Example
In a real application:
User registers → password is hashed using bcrypt
Stored in database securely
During login → password is verified using stored hash
Even if the database is compromised, attackers cannot easily recover original passwords.
Advantages of Using Bcrypt in .NET
Limitations to Consider
When Should You Use Bcrypt?
Use bcrypt when:
Building authentication systems
Handling user credentials
Developing secure APIs or web applications
Summary
Implementing secure password hashing using bcrypt in .NET is essential for protecting user data and building secure applications. By hashing passwords before storing them, using built-in salting, and verifying credentials properly during login, developers can significantly reduce security risks. Bcrypt provides a strong, industry-standard approach that balances security and performance, making it a reliable choice for modern ASP.NET Core applications.