Question Convert Hash value to String

[bala4unow]

Hello,
I stored my password as hash value (i.e., 2353) in SQL Server 2008 and now I need to convert it to string format which i actually inserted password.

For eg: 2353 = admin

 

[jmcilhinney]

When you hash data you get a Byte array. The logical way to convert arbitrary Bytes to a String is using base-64, e.g.

myString = Convert.ToBase64String(myByteArray)

 

[bala4unow]

Can you please give me the complete code. I'm getting error.

My Code:
Dim Hashpass As String
Dim ByteArray() As Byte
ConnectionOpen()
TempCommand.CommandText = "SP_RecoverPassword"
TempCommand.Parameters.AddWithValue("Username", RecoverPasswordUsernameTextBox.Text)
TempAdapter.Fill(TempDataset)
If TempDataset.Tables(0).Rows.Count > 0 Then
ByteArray = TempDataset.Tables(0).Rows(0)("Password")
Hashpass = Convert.ToBase64String(ByteArray)
End If
Msg.SaveMessageBox(Hashpass)
ConnectionClose()

I need to convert to string format

 

[jmcilhinney]

Hold on a minute! This is a fine example of why you should give a FULL and CLEAR explanation of the WHOLE problem in the first place. That means explaining what you're trying to achieve as well as how you're trying to achieve it. It appears to me that you are trying to provide a feature that will give the user their password if they've forgotten it. Is that the case? If so then forget it. The whole point of hashing is that it is one-way. The whole point of hashing is that you can NEVER determine what the original value was from the hash.

 

[bala4unow]

You are right. I'm trying to provide a feature that will give the user their password if they've forgotten it. What is the procedure to convert hash value to original string format.

Remember: Newton's 3rd law - "Every action has equal & opposite reaction"

Why can't we covert hash value to string ? There might be some other way to convert.

 

[jmcilhinney]

You're not listening. The fact that you think it could work or should work makes no difference. The reason that we can't convert a hash back to the original string is because that is exactly what hashing is for: to convert data to another value that cannot then be used to recreate the original data. Hashing exists specifically to prevent what you're trying to do. It is a one-way operation. That's it, that's all. If you want to be able to recreate the original data then you need to use encryption, not hashing.

 

[Herman]

MD5, SHA, CRC, are all one-way hashing algorithms. They only contain a fingerprint of the original data. The whole point is that if anyone gets a hold of the hash, it can never be reverted to plain text. With hashed passwords, the user enters a password, you hash it and compare the hash with the one you have stored. If they match the password was good. You should not try to give the users their password back, but you CAN let the user change his password if he has forgotten it. Verify some other info and let him change the password. This way if someone else changes it, the real user contacts you because he can't log on anymore.

Plain text passwords have been mostly extinct for the last 20 years.

 

[Herman]

Also a hash should not look like "2353". A MD5 hash looks like "f684b2f3d4218ee06dad551b3bb2074b". A SHA256 hash looks like "4546285f241bfae5c7272c48ae74e201d8e90f755515bd73a1ee16f3c1e3817d".