title: Is this the way to salt and store a Password in Db?
body: <p>There are seveal ways (even here in SO) and they all mention that the best way to keep password on database is to save, not the password, not the hased password, but to <strong>store the hash of a salted password</strong>.</p>
  
  <p>My question is simple, putting some code on it, is this the correct way?</p>
  
  <pre><code>string username = "myUsr";
  string password = "myPwd";
  DateTime createDate = DateTime.UtcNow;
  
  // Salt it
  string saltedPwd = String.Concat(password, createDate.Ticks.ToString());
  
  // Hash it
  HMACSHA1 hash = new HMACSHA1(Encoding.Unicode.GetBytes(Helper.EncryptKey));
  string encodedPwd = Convert.ToBase64String(
                          hash.ComputeHash(Encoding.Unicode.GetBytes(saltedPwd)));
  
  // Create User in the database
  db.CreateUser(username, encodedPwd, createDate);
  </code></pre>
  
  <p><em>Database User Table</em></p>
  
  <pre><code>user_id | username | password | create_date | last_access | active
  </code></pre>
  
  <p>and upon Login use do the process again and check if the <code>encodedPwd</code> is the same as the salted, hased password that was provided.</p>
  
  <p>My only concern is, <strong>is this the best way to salt a password?</strong> Is it ok to use the Created Date (as that will always change, and I read that it is best to use always a different <code>salt</code> every time we encode a password...</p>
  
  <p>Or should be the <code>salt</code> a completely different variable?</p>