title: HashPasswordForStoringInConfigFile - Different Hashes for same password
body: <p>I have recently implemented Hashing for my passwords in a project I am working on, and I cant seem to figure out what is going wrong.</p>
  
  <p>It seems that the HashPasswordForStoringInConfigFile() function is returning different values for the same password.</p>
  
  <p>I have the following code implemented which actually closely resembles the recommended algorithm to use on the MSDN documentation.</p>
  
  <p>I know that SHA1 hashing is not considered very safe, but this is for a research application, and I am not too worried about it at this point.</p>
  
  <pre><code> public const int DefaultSaltSize = 5;
      private static string CreateSalt()
      {
          RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
          byte[] buffer = new byte[DefaultSaltSize];
          rng.GetBytes(buffer);
          return Convert.ToBase64String(buffer);
      }
  
      public static string CreateHash(string password)
      {
          string salt = CreateSalt();
          string saltAndPassword = String.Concat(password, salt);
          string hashedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(saltAndPassword,"SHA1");
          hashedPassword = string.Concat(hashedPassword,salt);
          return hashedPassword;
      }
  
      public static bool VerifyPassword(string username, string password,AccountDataContext context)
      {
          var user = context.UserAccounts.FirstOrDefault(p =&gt; p.UserName == username);
          if (user != null)
          {
              string salt = user.Password.Substring(user.Password.Length - DefaultSaltSize);
              string hashedPassword = CreateHash(password);
              return hashedPassword.Equals(user.Password);
          }
          return false;
  
      }
  </code></pre>
  
  <p>Simply put, If I have the following code.</p>
  
  <pre><code>string password1 = "password";
  string password2 = "password";
  
  var hashedPassword1 = CreateHash(password1);
  var hashedPassword2 = CreateHash(password2);
  
  var match = hashedPassword1.Equals(hashedPassword2);
  
  //match should be True, but it is turning out False.
  </code></pre>
  
  <p>It seems that the FormsAuthenticationForStoringInConfigFile() is not returning the same hash for password1 and password2 in the CreateHash() method.</p>
  
  <p>I understand with the salt applied they are not the same, but if you see in the code, I am removing the salt before comparing the two hashedPasswords for equality.</p>
  
  <p>What could possibly be causing password1 and password2 from being hashed differently?</p>