.NET Patterns: Architecture, Design, and Process

Password Storage

Intent

This pattern (actually more of a best practice) provides an easy method of adding some level of encryption for password storage.

Problem

Many applications still store passwords in clear text. Because most of the code is already written to provide at least some level of encryption, there is little excuse for not providing it.

To understand this pattern, you must first understand the concept of a one-way hash. A simple definition of a one-way hash is a scrambled version of a string that cannot be easily unscrambled to get the original string back. To store the password, the hash is generated for the password to be stored. We'll call the stored hash value hash¹. When the user comes to the site and enters his or her password, ...