How deeply does ASP.NET Core in Action, 3e cover password hashing?

Recommends hash-only storage and strong algorithms but does not explain hashing internals or algorithm selection.

Password hashing

As explained in ASP.NET Core in Action, 3e

A password hash is a one-way derived value stored instead of the plaintext password for later password verification.

Password hashing stores a derived value instead of the plaintext password, so an application can retain user credentials without keeping the original password. Use a strong hashing algorithm and let an established identity system handle the security-sensitive details. section 29.5 section 23.2

ASP.NET Core Identity includes password hashing alongside user storage, password validation, account lockout, multifactor authentication, and password-reset support. This avoids manually building an authentication and membership system while leaving the login UI and some integrations to the application. section 23.1.2 section 23.2

Practical guidance:

Store passwords only as hashes; do not retain plaintext passwords. section 29.5
Prefer ASP.NET Core Identity or an external identity provider instead of writing password and membership handling manually. section 23.1.2 section 23.2
Combine password hashing with password protection against weak or compromised passwords and with MFA where possible. section 29.5 section 23.2

Table 23.1 Which services are and aren’t handled by ASP.NET Core IdentityCH23.fm (view table figure)

Managed by ASP.NET Core Identity	Requires implementing by the developer
Database schema for storing users and claims	UI for logging in, creating, and managing users (Razor Pages or controllers); included in an optional package that provides a default UI
Creating a user in the database	Sending email messages
Password validation and rules	Customizing claims for users (adding new claims)
Handling user account lockout (to prevent brute-force attacks)	Configuring third-party identity providers
Managing and generating MFA/2FA codes	Integration into MFA such as sending SMS messages, time-based one-time password (TOTP) authenticator apps, or hardware keys
Generating password-reset tokens
Saving additional claims to the database
Managing third-party identity providers (for example, Facebook, Google, and Twitter)

Use the responsibility table to distinguish password hashing and validation, which Identity manages, from login UI and external messaging, which the application may need to provide. section 23.2

How ASP.NET Core in Action, 3e covers it

liveBook manning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Build Python Web Apps with StreamlitPassword hashing is the process of transforming passwords into one-way cryptographic representations for safer credential storage.
liveBook manning.com

Real-World CryptographyThe use of a deliberately configured password-processing function to derive values suitable for storing and verifying passwords without retaining the passwords themselves.
liveBook manning.com

Rust Servers, Services, and AppsPassword hashing is the one-way transformation of a password into a value intended for secure storage and later verification.
liveBook manning.com

Just Use Postgres!A password hash is a one-way derived value representing a password, typically incorporating the salt needed for later verification.

Compare how 5 books explain password hashing →

Related concepts

Argon2includes · Argon2 is a memory-hard password-hashing and key-derivation algorithm designed to make password-guessing attacks costly in time and memory.
hash functionuses · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.
cryptproduced by · crypt is a pgcrypto function that hashes a password with a salt and can reproduce a hash for password verification.
encryptioncontrasts with · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
cryptographic saltused by · A cryptographic salt is an additional typically random value combined with input before hashing to distinguish identical inputs and hinder precomputed attacks.
hash valueuses · A hash value is a deterministic, typically fixed-size value produced by applying a hash function to input data, often for lookup, comparison, identification, or integrity checking.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.