What type of security should I use if I wish to have a Forgotton Password ability on our website? AES? <p>unfortunately, we've been requested to offer our users the ability to get an email sent to their registered account, their password .. if they have forgotten their password.</p> <p>"Click here if you have forgotten your password"</p> <p>So - this means i need to be able to DECRYPT the password. I don't like it, but that's the requirements. I'm used to use a SALT and HASHING a password with SHA1. then storing the salt and the hashed password into the repository. </p> <p>Not sure what I should be doing if I wish to store the password which can be decrypted now. Is it more or less the same, but I should use AES instead?</p> <p>Would love some help (and preferably code samples in .NET).</p> <p>Cheers!</p> <p>NOTE: Please don't turn this thread into a topic about HASHING vs DECRYPTING vs OpenAuth.</p>