title: ASP.NET: Forms authentication across applications: matching password encryption settings
body: <p>I have two websites that both create users in their own separate ASP.NET authentication databases.  Below is the Web.configs for both. I also made the <code>aspnet_Applications</code> database records identical on both solutions. When I create a user, the encrypted passwords are not identical, nor are the password salts.</p>
  
  <p><strong>Any idea how to make two websites create the same password hashes when both systems have the same user name and password?</strong></p>
  
  <pre><code>&lt;configuration&gt;
    &lt;system.web&gt;
      &lt;authentication mode="Forms" &gt;
        &lt;!-- The name, protection, path, validationKey, validation, decryptionKey,
             and decryption attributes must be identical across all applications. 
        --&gt;
        &lt;forms loginUrl="~/Account/Login"
               name=".ASPXAUTH" 
               protection="All"  
               path="/" 
               domain="contoso.com" 
               timeout="2880"
               requireSSL="false" 
               cookieless="UseCookies" 
               enableCrossAppRedirects="true" /&gt;
      &lt;/authentication&gt;
      &lt;!-- Validation and decryption keys must exactly match and cannot
           be set to "AutoGenerate". The validation and decryption
           algorithms must also be the same. --&gt;
      &lt;!-- The validationKey is not wrapped in the solution --&gt;
      &lt;!-- These keys are examples --&gt;
      &lt;machineKey
           validationKey="C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D940
                          1E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51
                          F17C529AD3CABE" 
           decryptionKey="8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F" 
           validation="SHA1"
           decryption="Auto" /&gt;
    &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>