Setting the user password format

There are multiple different formats that can be used to store passwords in the database. They may be saved either in plain text (not recommended) or as the result of a security hash function.

You can choose which option to use in Settings -> Security & Membership -> Passwords via the Password format setting:

• The default and recommended option is SHA2 with salt.

Password salt

Passwords are usually stored using the SHA-2 hash function with the additional application of a salt. A salt is a string appended to passwords before they are hashed, which helps protect the passwords against dictionary or other types of brute force attacks. It also ensures that every user has a different password hash, even if multiple users have the same password.

Kentico adds two types of salt to the password:

• User salt - by default, the GUID of each user (stored in the UserGuid column) is appended to the passwords before the hash function is applied. If necessary, you can customize the system to use a different user column as the password salt [requires hotfix 9.0.5]. To customize the default user salt, add the following key into the <appSettings> section of the web.config file and type the column name as the value. For example:

  Copy

  
  
  
    <add key="CMSUserSaltColumn" value="UserName" />
  
  
    

• Password salt - to increase the length of the salt (to further improve the security of hashed passwords), you can define a custom string that the system appends to every password. Add the following key into the <appSettings> section of your web.config file:

  Copy

  
  
  
   <add key="CMSPasswordSalt" value="SaltText" />
  
  
   

The following diagram shows how the password and salt values are composed before the hash function is applied: