title: ASP.NET Identity - where is the salt stored?
body: <p>I created a simple MVC4 app and registered a user.  The usrname and password are stored in a table called: AspNetUsers.  This table does not have a salt field.</p>
  
  <p>The way I understood is that when a user logs in; they enter a username and password.  The salt is then concatenated with the password entered and compared to the password in the database.  Is that not correct? i.e.</p>
  
  <pre><code>Hash(PasswordEntered) + Salt = Password in database = authenticated
  Hash(PasswordEntered) + Salt &lt;&gt; Password in database = not authenticated
  </code></pre>
  
  <p>There is a field called: aspnetusers.SecurityStamp, however my research tells me that this is not the Salt.</p>
  
  <p><strong>Update</strong></p>
  
  <p>I have just read Scott Chamberlain.  Please see the steps below:</p>
  
  <p>1) A user enters: Hello123 as the password during registration and the Salt (randomly generated) is: 456, then the password entered into PasswordHash is: Hello123+456<br>
  2) The user then attempts to login and types Hello123 (correctly) as the password.  The salt (randomly generated) is: 567.  Therefore Hello123+456 is compared to Hello123+567 and the authentication fails.  </p>
  
  <p>In this case the user enters the correct password and is not authenticated.  I am obviously missing something fundamental here.</p>