Does this look like a good method to hash a user password? I'm not very familiar with how this whole hashing process works and below is a bunch of stuff I've seen on many different posts.My main concern are all of the numbers.  Do they all need to match?  Do they need to match something like the array.copy?And then the array.copy lines.  I just want to try and understand it better before I move forward with it further.public const int SALT_BYTE_SIZE = 16;public const int HASH_BYTE_SIZE = 20;[ChildActionOnly]private static void CreateHash(string password){    // Generate Random Salt    RNGCryptoServiceProvider csprng = new RNGCryptoServiceProvider();    byte[] salt = new byte[SALT_BYTE_SIZE];    csprng.GetBytes(salt);    // hash value    var pbkdf2 = new Rfc2898DeriveBytes(password, salt, 10000);    byte[] hash = pbkdf2.GetBytes(20);    // combine salt + hash    byte[] hashBytes = new byte[HASH_BYTE_SIZE];    Array.Copy(salt, 0, hashBytes, 0, 16);    Array.Copy(hash, 0, hashBytes, 16, 20);    // Convert hash into string to DB storage    string savedPasswordHash = Convert.ToBase64String(hashBytes);    // save to DB}
Hashing a password
c#;hashcode
Looks fine for the most part. The main thing here is to make sure that the function to generate and compare the hash with existing matches what you have.As far as Array.Copy, check out MSDN for this particular overload.Since you set the salt and hash size to 16 and 20 accordingly, what it's doing below is copying the value from salt and hash into the hashBytes array.Array.Copy(salt, 0, hashBytes, 0, 16);Array.Copy(hash, 0, hashBytes, 16, 20);hashBytes will store bytes from salt on index 1-15, and the next line, bytes from hash will be stored on index 16-35.The problem with this is your byte[] hashBytes = new byte[HASH_BYTE_SIZE] is being set to 20 which is not equal to the size of the salt (16) and hash (20) combined. It will NOT work since the size of the array is not big enough to hold the range of values being stored.It should be below to accommodate the combined size of the hash and the salt:byte[] hashBytes = new byte[SALT_BYTE_SIZE + HASH_BYTE_SIZE];