I am using a membership provider in my website with password format setting is hashed (the default). I want to check for the user's input password manually by comparing it with the one stored in the database. I searched for a direct method that does this work but found nothing, so I tried to make the work manually: getting the input password then hashing it using (sha1) then comparing it with the one in the database. I used this way to hash the input password:

string hashedPassword = FormsAuthentication.HashPasswordForStoringInConfig File(OldPasswordTextBox.Text, "sha1");

and then compared it with the one in the database but it was completely different. Here is an example: If the password is '123456' the hashed version of it is '7C4A8D09CA3762AF61E59520943DC26494F8941B' but the one in the database is 'hNemTUHlBI3Oj4Q5ZF6mM8T81XU='

Is that because of using PasswordSalt? if so then how can I simulate the PasswordSalt to achive what I want to do?

I always used the SHA1 class directly.
if it required a salt I would generate it by hand with the RNGCryptoServiceProvider provider to generate my salt I add on.

I got the info from this link at Microsoft:
http://msdn.microsoft.com/library/de...redentials.asp

Using the SHA1 class directly should give you more predictable results. Think what you were using is for storing. Also, i am just looking but that one with the "=" at the end almost looks like it used an encryption algorythm vs hash. I could be wrong. I built an encryption class that has the output almost like that last hash you put out when done.

I've found a very easy way to do that, that is by using Membership.ValidateUser method. I got the username of the logged user by Membership.GetUser().UserName and used it as the first argument in the ValidateUser method, then catch the user's input password as the second argument. The idea is when the user tries to change his password or email from his control panel he must input his old password before any further processes.