C#

Richard Deeming wrote:

well-respected developer

public static bool CompareHashedString(string hashedPWDFromDB, string passwordFromUser)
{
    bool isValid = true;

    byte[] salt = new byte[16];

    byte[] hashBytes = Convert.FromBase64String(hashedPWDFromDB);

    Array.Copy(hashBytes, 0, salt, 0, 16);

    var pbdkdf2 = new Rfc2898DeriveBytes(passwordFromUser, salt, 10000); // Hash the passwordFromUser

    byte[] hash = pbdkdf2.GetBytes(20);

    for (int i = 0; i < 20; i++)
    {
        if (hashBytes[i + 16] != hash[i])
        {
            isValid = false;
            break;
        }
    }

    return isValid;
}