title: Is PasswordFormat.Encrypted secure for Asp.Net membership provider?
body: <p>I'm using the the membership provider on a site and it's worked well for years. Today, I revisited the site and am now concerned about the password format option. I need the ability for users to reset their password, but now we don't need password retrieval, although we need security Q&amp;A before they reset.  Below are some of the provider settings I'm using.</p>
  
  <p>enablePasswordRetrieval="true" 
  enablePasswordReset="true"
  passwordFormat="Encrypted"</p>
  
  <p>Mainly, I'm concerned about the security of passwordFormat="Encrypted". PasswordFormat="Hashed" looks much tighter but with a lot of accounts in the database, I'm not sure how I would convert.</p>
  
  <p>Is it possible to convert this late in the game? If not, is my site secure?</p>