views:

169

answers:

2

setting type to hashed seems to not allow enablePasswordRetrieval. what if a user forgot their password?

+5  A: 

When a hashed password is lost, the only option is to create a new one. Either by the user or by an administrator(-tool).

A common practice is to send a link to a secured page where the user can enter a new password.

Henk Holterman
+1  A: 

Hashes are not-reversible to their native form, which is why password recovery is not possible. If this is a requirement you will need to use encryption instead. To do this, change passwordFormat="Hashed" to passwordFormat="Encrypted"

JoeGeeky