Question

Which is the Preferred Method of Storing Passwords In Database

Answer 1

Generally, we can use the sha hash of the username, a guide in the web config, and the password, stored as a varchar(40). If they want to brute force/dictionary they'll need to hack the webserver for the guide as well. The username breaks creating a rainbow table across the whole database if they do find the password. If a user wants to change their username, I just reset the password at the same time.

System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(
    username.ToLower().Trim(),
    ConfigurationManager.AppSettings("salt"),
    password
);