Password saving .NET

You should never ever store passwords in their original form. If you think about it: you never need them for authentication, as you can always compare encrypted log-in password with you stored encrypted password. With public-key cryptography, you also don't have to store a private key (which is a ciphering key in this case; knowledge of a public key helps to decipher, but not cipher).

You can also store cryptographic hash of the password.

For strong ciphering I would advice RSA, see http://en.wikipedia.org/wiki/RSA[^], use System.Security.Cryptography.RSA, System.Security.Cryptography.RSACryptoServiceProvider, see http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsa.aspx[^]. You need to understand Public-key Cryptography, see http://en.wikipedia.org/wiki/Public-key_cryptography[^].

For the Cryptographic Hash approach, you need to understand how a Cryptographic Hash Function work, see http://en.wikipedia.org/wiki/Cryptographic_hash_function[^].
For a Cryptographic Hash function, you can use, for example the one from the SHA-2 family, see http://en.wikipedia.org/wiki/SHA1[^]. It is implemented in .NET, see http://msdn.microsoft.com/en-us/library/system.security.cryptography.sha1.aspx[^].

Warning: Do not use MD5! (See http://en.wikipedia.org/wiki/MD5[^].) This algorithm is considered "broken", should never be used for any security purposes.

[EDIT]
In response to last comment by OP (on "reversible", see my response comment):
Assymmetric ciphering and public-key cryptography is based on the idea of one-way function, see http://en.wikipedia.org/wiki/One-way_function[^], see also trapdoor function: http://en.wikipedia.org/wiki/Trapdoor_one-way_function[^]. Everything is based on non-reversible algorithm.

[EDIT]

Also, don't use SHA-1 for security purpose — a security flaw was found. Please see
http://en.wikipedia.org/wiki/Sha-1[^].

—SA

Like Nish said, there are way too many factors, situations, and possible requirements. We have no idea of the environment you're in, how secure it has to be, or anything even remotely associated with access control. It's a decision only you can make.

To add to what SA said: When you store a hash of a password, do not hash the raw password either: include the UserID or UserName or other unique-to-this-user information with it before you generate the hash.

Otherwise, if two users have the same password, they will have the same hash. This can be used to break into systems, by inserting your guess as to the password and comparing it to other users hash value. Since this isn't an attempt to log in with the wrong password it is difficult to spot as an intrusion attempt.

Additionally, since many users set the password to something they remember = "password" for example - a quick look at the database hashes can immediately isolate the likely targets for easy guessing.

Including the UserID with the password in the hash prevents these quite simply!