1

I'm trying to compare two hashes generated by PasswordHasher func, I don't know why if password and confirmPassword have the same string, "if" return false.

string passwordHash = UserManager.PasswordHasher.HashPassword(password);
string confirmPasswordHash = UserManager.PasswordHasher.HashPassword(confirmPassword);
  if (passwordHash != confirmPasswordHash)
  {
     ModelState.AddModelError("", "Not the same");
     return View(user);
  }

private AppUserManager UserManager
{
  get { return HttpContext.GetOwinContext().GetUserManager<AppUserManager>(); }
}

So how to properly comparing hashes?

user3609885
  • 66
  • 1
  • 8
  • Use String.Equals? Maybe it's saying that they do not share the same memory address – DotNetRussell Mar 03 '15 at 18:23
  • 2
    Why do you need to compare the hashed versions? Why not compare `password` directly to `confirmPassword`? – mason Mar 03 '15 at 18:24
  • 1
    Maybe the real question is why are you not hashing the password on the client machine and then sending back to your server? – DotNetRussell Mar 03 '15 at 18:26
  • Anthony: But can I do it with Identity? mason: I could, but I wanted to check something, and I don't know why PasswordHasher generate diffrent hash for the same string? – user3609885 Mar 03 '15 at 18:33
  • it's explained very clearly in the duplicate post how the Hasher uses a Key Derivation Function which includes a random salt in it's output. To verify the hash, the output is split back apart again to retrieve the salt. – Claies Mar 03 '15 at 18:41
  • It;s not the same question, it's more specific and concise. – Choco Sep 07 '18 at 02:52

0 Answers0