I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this a secure way to generate a one time use password?


Yup, it's fine. Underneath the covers it users the RNGCryptoServiceProvider to generate the password data, which is .NET's wrapper around the CryptoAPI's CSPRNG to generate the data for the password. It's good enough for strongly random key material, so its certainly also good enough for a one-time use password as well.

  • @bdawg Note that while it's a very secure way to generate secure random strings, it's actually a very bad way to generate passwords. You have no control over the character set and you'll end up with passwords like this i.imgur.com/1usU3E8.png that are horrible to handle, give to users, write down, type. The only good time to use it is when you're generating passwords that go into your password manager. – Adi Mar 15 '16 at 21:50
  • @bdawg For a better alternative that you can control, have a look at CodesInChaos' answer here stackoverflow.com/a/19068116 – Adi Mar 15 '16 at 21:52
  • @adi yes I am aware of this. The passwords are unrememberable. – bdawg Mar 15 '16 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.