title: ASP.Net Identity Manual Password Hashing
body: <p>I'm developing an <strong>MVC 5</strong> web application using <strong>Entity Framework Database First</strong> approach with an <strong>existing database</strong>.</p>
  
  <p>I'm also using <strong>ASP.Net Identity</strong> for my Authorisation and Authentication, however, I'm not using the built in Entity Framework code, i.e., <strong>UserManager</strong>, <strong>ApplicationUser</strong> etc instead I'm using an approach similar to this by Brock Allen.</p>
  
  <p><a href="http://brockallen.com/2013/10/24/a-primer-on-owin-cookie-authentication-middleware-for-the-asp-net-developer/" rel="noreferrer">http://brockallen.com/2013/10/24/a-primer-on-owin-cookie-authentication-middleware-for-the-asp-net-developer/</a></p>
  
  <p>I'm now working on Account Login and Registration and I want to <strong>hash the User password</strong> before I store it in my custom User table.</p>
  
  <p>I realise I can create my own custom class which implements <strong>IPasswordHasher</strong>, however, that's where I become stuck. Below shows a mock up of how I think it should work, however, I'm not entirely sure this is even correct.</p>
  
  <pre><code>public class CustomPassword : IPasswordHasher
  {
      public string HashPassword(string password)
      {
          return password;
      }
  
      public PasswordVerificationResult VerifyHashedPassword(string hashedPassword, string providedPassword)
      {
          if (hashedPassword.Equals(providedPassword))
              return PasswordVerificationResult.Success;
          else return PasswordVerificationResult.Failed;
      }
  }
  </code></pre>
  
  <p>These are my questions:</p>
  
  <p><strong>Q1</strong>:When registering a new user account and I pass the user password
      into the HashPassword method from my Account Controller, like this,
      I would like the User password hashed and returned as a string,
      however, I don't know what code to put into the <strong>HashPassword</strong>
      function to do this.</p>
  
  <pre><code>CustomPassword pwd = new CustomPassword();
  String UserPassword = "test@123";
  String HashedNewPassword = pwd.HashPassword(UserPassword);
  </code></pre>
  
  <p><strong>Q2</strong>:When a User then logs into the website, I would like to take their supplied password, retrieve the hashed password from the database user table, and then compare them inside the <strong>VerifyHashedPassword</strong> method, but again, I don't know what the code is to compare a hashed string against a non-hashed string.</p>
  
  <p>I would greatly appreciate any advice on how to do this.</p>
  
  <p>Thanks.</p>