title: Which of the .NET included hashing algorithms are suitable for password hashing?
body: <p>The <a href="https://www.f-secure.com/weblog/archives/00002379.html" rel="nofollow noreferrer" title="Redux: Are you sure SHA-1+salt is enough for passwords?">password leak of LinkedIn</a> proved how important it is to securely hash your passwords. However, even hashing passwords with a salt is not secure with the 'normal' hashing algorithms (such as MD5 and the SHA family), since they are optimized for speed, which allows hackers compute 2300 million hashes per second (brute force).</p>
  
  <p>There are hashing algoritms that are safer to use because they are much more computational intensive, such as <a href="https://en.wikipedia.org/wiki/PBKDF2" rel="nofollow noreferrer">PBKDF2</a>, <a href="http://www.openwall.com/crypt/" rel="nofollow noreferrer">Bcrypt</a>, PBMAC, and <a href="https://www.tarsnap.com/scrypt.html" rel="nofollow noreferrer">scrypt</a>. These hashing algorithms however, don't seem to be included in the .NET framework.</p>
  
  <p>So, which performance intensive hashing algorithms are included in the .NET framework?</p>
  
  <p><strong>ANSWER:</strong> PBKDF2 is included in the framework and <a href="https://www.owasp.org/index.php/Using_Rfc2898DeriveBytes_for_PBKDF2" rel="nofollow noreferrer">this site shows how to use it properly</a>.</p>