how decrypt the password field in built in database of ASP.NET

Question

0.00/5 (No votes)

See more:

im using the built in database in asp.net , i wanted to know the user details and their passwords . i can get the user details but i cannot fetch their passwords , it's in encrypted format. so how do i fetch the password details..

Posted 24-Feb-14 1:04am

kishorebt

Add a Solution

Comments

Richard MacCutchan 24-Feb-14 7:08am

You don't. Passwords are encrypted for a reason.

kishorebt 24-Feb-14 7:16am

if the admin wants to know the password of a particular user then how to access those passwords. if they are encrypted , there must be way to decrypt them ...

Nitij 25-Feb-14 1:14am

Passwords are generally stored after hashing with a salt which is a one way encryption and it is not feasible to decrypt them.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Snesh Prajapati · Accepted Answer · 2014-02-24T01:17:00

You need to change the "membership" setting in Web.Config in order to able to see the password as text. Anyway it is not a good practice to save password as plain text.

After the change in setting...if you will register a new user, application will save the password as plain text. So to verify the approach, you need to register a new user and check. Following are the changes, we need to make:

1. Comment out existing membership provider:

<!--<membership defaultProvider="DefaultMembershipProvider">
     <providers>
       <add name="DefaultMembershipProvider" type="System.Web.Providers.DefaultMembershipProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" />
           </providers>
   </membership>-->

2. Add new provider:

<membership defaultprovider="MyMembershipProvider">
  <providers>
    <clear />
    <add name="MyMembershipProvider"
         type="System.Web.Providers.DefaultMembershipProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
         connectionStringName="DefaultConnection"
         maxInvalidPasswordAttempts="5"
         passwordAttemptWindow="10"
         minRequiredNonalphanumericCharacters="0"
         minRequiredPasswordLength="4"
         passwordStrengthRegularExpression=""
         passwordFormat="Clear"
         enablePasswordReset="true"
         enablePasswordRetrieval="false"
         requiresQuestionAndAnswer="false"
         requiresUniqueEmail="true" />
  </providers>
</membership>

You can see here passwordFormat="Clear", so password would not be encrypted any more for incoming user.

The parameter

type="System.Web.Providers.DefaultMembershipProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"

must be valid....so you can use existing value of type as it was in the commented code as per point 1.

The value of "connectionStringName" must be valid so whatever name you have provided for connection string just use that one.

Hope it would help. Thanks.