It's better practice to hash a password rather than encrypt it. Very basically, hashing is a one-way mechanism whereas encryption is reversible.

Why's this important? Well, if a malicious entity (which could be an employee) finds how you've encrypted the data (either by brute force or just stealing the key etc.) they can decrypt it - and then (mis)use your customers passwords, most of which will have been re-used elsewhere.

With a hash, you can know how a hashed value has been generated, but you won't know the value (their password) that's generated it. Unless, of course, you're not securing the communication between the server at log on (HTTP instead of HTTPS web pages, for example).

As for how to implement it in .NET, see this question (and answers) from Stack Overflow:

http://stackoverflow.com/questions/19957176/asp-net-identity-password-hashing