save encrypted pass word

darma teja

Hi,

I would like to add username and password from my user interface to my database table.

There was already a old password in the data table.
Here is the encrypted password: FC64474D0994379EA2FC8E8E320770EA58C3554B

I would like to save my new password in the same encryption.

How can i solve this issue?

Thanks,
Darma

8 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vulpes13y ago
Accepted answer
Assuming SHA-1 was used or you're happy to use it in future, here's how you can encrypt a given password in the form of a hex string for storing in the database:

using System;
using System.Text;
using System.Security.Cryptography;

class Program
{
static void Main()
{
string password = "New73Ok18"; // or whatever
byte[] pwBytes = Encoding.UTF8.GetBytes(password);
byte[] hash = SHA1.Create().ComputeHash(pwBytes);
// express byte array as hex string
StringBuilder hex = new StringBuilder();
for(int i = 0; i < hash.Length; i++) hex.Append(hash[i].ToString("X2"));
Console.WriteLine(hex.ToString());
Console.ReadKey();
}
}

The output is:

9E8806971A97BDCDF87F5731DA938A9E18A68B54
Ken H13y ago
Thank for Vulpes.
Vulpes13y ago
Ken,

When a user attempts to sign in, you first look for his/her user name in the database.

If it's not there, you inform the user that it's an invalid user name and/or password.

If it is there, you hash the password entered using SHA-1 and compare it with the hashed password in the user's record in the database.

If they're the same, then the user has successfully logged in.

Otherwise, you inform the user that it's an invalid user name and/or password.

Simple but effective :)
darma teja13y ago
Hi Vulpes,

Wonderful, it works.

Thanks
Darma
Ken H13y ago
So, how to compare user-entered password with the database stored encrypted password?
Vulpes13y ago
I'm afraid you can't, Ken.

SHA-1 is basically a hashing algorithm which provides 'one way' encryption. It's therefore often used for passwords - you just compare the hash of the password entered with the one stored in the database - and you never actually know what the password is.

However, nowadays a 20 byte hash isn't considered 100% secure and, if more security is needed, you'd be better using SHA-256 (32 bytes) or stronger.
Ken H13y ago
hi Vulpes,
How to restore the original look encrypted characters.
for example:9E8806971A97BDCDF87F5731DA938A9E18A68B54 ==>New73Ok18

Thank you.
Vulpes13y ago
Do you know what type of encryption was used?

If you don't, then my guess is that it was SHA-1 because the encrypted password is 20 bytes long.