I set up the membership system to use SHA1 because I wanted to be able to manually reset passwords if I had to with a known and easy-to-hash alogorithm.
And so I selected SHA1 in my web.config: 'passwordFormat="Hashed"' (it defaults to SHA1).
BUT
In the my_aspnet_Membership table, both the Password column and the PasswordKey column are filled out.
Let's take, for example, the string "crippen"
When I SHA1 it, I get: 643a9e46a5240777b93af9f6c8e0711e2912b83e
in the database it's:
Password: 6Ou2HJQuSEHxLbsSMZgeTpHuj90=
PasswordKey: B+LGKhw2EQRs6oGyntFv8g==
How the heck is Microsoft generating hashes?!
Thanks!
...
Go to the complete details ...