Question

So, I try to check if passwords match.

This is the encryption I use, once when the data is inserted in the database, once to check if the inserted password on the login field matches the one from the database:

 byte[] pass = Encoding.UTF8.GetBytes(password);
 MD5 md5 = new MD5CryptoServiceProvider();
 string newPass = Encoding.UTF8.GetString(md5.ComputeHash(pass));

But every time I try to login (with correct details), it does not work. In the debugger, this is the string that comes from the database:

?]??$PL??f??6?

And the one encrypted from the login field:

�]��$PL��fඇ�6�

I suppose it’s an encoding problem, but can’t seem to figure it out myself.

Answer 1

This line is inappropriate:

string newPass = Encoding.UTF8.GetString(md5.ComputeHash(pass));

ComputeHash returns arbitrary binary data. Either you should keep it as binary data, or if you do need to convert it to text, use Base64 to convert it in a way which will allow you to get back the original data later:

string base64Hash = Convert.ToBase64String(md5.ComputeHash(pass));

You should be fine to store that as a normal string – it’ll just be ASCII.

(I wouldn’t personally use MD5 to hash passwords, but that’s a different conversation.)