{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Identity/issues/691","labels_url":"https://api.github.com/repos/aspnet/Identity/issues/691/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Identity/issues/691/comments","events_url":"https://api.github.com/repos/aspnet/Identity/issues/691/events","html_url":"https://github.com/aspnet/Identity/issues/691","id":123494218,"number":691,"title":"How do I retrieve password?","user":{"login":"weitzhandler","id":2716316,"avatar_url":"https://avatars.githubusercontent.com/u/2716316?v=3","gravatar_id":"","url":"https://api.github.com/users/weitzhandler","html_url":"https://github.com/weitzhandler","followers_url":"https://api.github.com/users/weitzhandler/followers","following_url":"https://api.github.com/users/weitzhandler/following{/other_user}","gists_url":"https://api.github.com/users/weitzhandler/gists{/gist_id}","starred_url":"https://api.github.com/users/weitzhandler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weitzhandler/subscriptions","organizations_url":"https://api.github.com/users/weitzhandler/orgs","repos_url":"https://api.github.com/users/weitzhandler/repos","events_url":"https://api.github.com/users/weitzhandler/events{/privacy}","received_events_url":"https://api.github.com/users/weitzhandler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-22T14:51:12Z","updated_at":"2015-12-22T16:47:53Z","closed_at":null,"body":"Hi,\r\n\r\nI'm in a scenario where I need to display the password to the user. How do I achieve that? I found no matching option on the `UserManager`."},"comment":{"url":"https://api.github.com/repos/aspnet/Identity/issues/comments/166670831","html_url":"https://github.com/aspnet/Identity/issues/691#issuecomment-166670831","issue_url":"https://api.github.com/repos/aspnet/Identity/issues/691","id":166670831,"user":{"login":"MaximRouiller","id":209384,"avatar_url":"https://avatars.githubusercontent.com/u/209384?v=3","gravatar_id":"","url":"https://api.github.com/users/MaximRouiller","html_url":"https://github.com/MaximRouiller","followers_url":"https://api.github.com/users/MaximRouiller/followers","following_url":"https://api.github.com/users/MaximRouiller/following{/other_user}","gists_url":"https://api.github.com/users/MaximRouiller/gists{/gist_id}","starred_url":"https://api.github.com/users/MaximRouiller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MaximRouiller/subscriptions","organizations_url":"https://api.github.com/users/MaximRouiller/orgs","repos_url":"https://api.github.com/users/MaximRouiller/repos","events_url":"https://api.github.com/users/MaximRouiller/events{/privacy}","received_events_url":"https://api.github.com/users/MaximRouiller/received_events","type":"User","site_admin":false},"created_at":"2015-12-22T16:47:53Z","updated_at":"2015-12-22T16:47:53Z","body":"Basic principle is... assume somebody is going to download your whole database and have all the time in the world to hack those passwords. \r\n\r\nIf you are using clear text... you are basically insane.  If you are using encryption with a single key, they only need this to get everything (bad!). If you use hashing, they have to try every password one by one to get them (better). If you use hashing with salting per accounts, then they can't match identical in your database (excellent!).  If you use hashing with a compute factor, then they will have an incredibly hard time finding individual passwords even if they use GPU farms to hack them (best so far!).\r\n\r\nYour point shouldn't be in sending the user his password. It should be in providing him a way to reset is password with a link sent to a confirmed email address. No need to send passwords.\r\n\r\nBut basically... use something somebody else already did. \r\n\r\n[Don't roll your own](http://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own)"}}