How should passwords be handled in a C# application?

Passwords should never be stored as plain text and should not be encrypted with a reversible application key for normal authentication storage.

They should be processed using a dedicated password-hashing algorithm with salts and an appropriate work factor. ASP.NET Core Identity provides secure password hashing and verification infrastructure and should generally be preferred over implementing password storage manually.

Applications should also enforce appropriate password and account policies, protect authentication endpoints against abuse, use HTTPS, and never log passwords.