Member Avatar for localp

I am new to C# and ASP.net. I have been asked to create a login screen which i have done. but i am sending messages as plain text. but the requirement is to not show the password that is sent across the network. How can i do this.

Any tutorial or sample code would help.

note: i have created the login scren, but clueless how to implement the security part.

  • 2 Contributors
  • 3 Replies
  • 88 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by tinstaafl

Dani AI

Generated

Short answer for : do not try to "hide" the password by inventing your own client-side encryption. Protect it in transit with TLS (HTTPS) and protect it at rest with a salted, slow hash on the server. 's links about encryption are useful for other tasks (cookies, tickets), but the login flow should rely on TLS for network confidentiality and on a key-derivation function for storage/verification — the server normally does not "decrypt" stored passwords.

Practical steps:

  • Turn on HTTPS for the site (get a certificate — e.g., Let's Encrypt for production; use a dev cert locally) and redirect/require HTTPS for login pages.
  • On the server, never store plaintext or reversible encryption of passwords. Store a unique salt + KDF output (PBKDF2/bcrypt/Argon2). Use a well-tested library or framework (ASP.NET Identity, BCrypt.Net, or an Argon2 implementation) rather than rolling your own crypto.
  • Implement verification by hashing the supplied password with the stored salt and comparing the results with a constant-time compare. If you need password recovery, use secure reset tokens rather than storing recoverable passwords.

Example (simple PBKDF2 pattern in C# — adapt parameters and prefer a modern KDF like Argon2 for new projects):

using System;
using System.Security.Cryptography;

public static class PasswordHasher
{
    const int SaltSize = 16;
    const int HashSize = 32;
    const int Iterations = 100000; // tune over time

    public static string Hash(string password)
    {
        byte[] salt = new byte[SaltSize];
        using (var rng = RandomNumberGenerator.Create()) rng.GetBytes(salt);

        using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, Iterations, HashAlgorithmName.SHA256))
        {
            byte[] hash = pbkdf2.GetBytes(HashSize);
            return $"{Iterations}.{Convert.ToBase64String(salt)}.{Convert.ToBase64String(hash)}";
        }
    }

    public static bool Verify(string stored, string password)
    {
        var parts = stored.Split('.');
        int iterations = int.Parse(parts[0]);
        byte[] salt = Convert.FromBase64String(parts[1]);
        byte[] hash = Convert.FromBase64String(parts[2]);

        using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, iterations, HashAlgorithmName.SHA256))
        {
            byte[] test = pbkdf2.GetBytes(hash.Length);
            return CryptographicOperations.FixedTimeEquals(hash, test);
        }
    }
}

Further reading and up-to-date guidance: see the OWASP Password Storage Cheat Sheet and NIST authentication guidance, and consider using ASP.NET Identity which handles these details for you (OWASP Password Storage Cheat Sheet, NIST SP 800-63B, ASP.NET Core Identity).

Recommended Answers

All 3 Replies

Member Avatar for localp

Thank you for your reply. How will the serverside decrypt the string and get the actual password ? and what might be the encrypion algorythm used here ?

Member Avatar for tinstaafl

This page has quite a few links to articles about encrypting and decrypting in Asp.net

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.