Salted password hashing plain and simple:

Rule 1: Use a Modern Hash Algorithm (bcrypt, PBKDF2, scrypt)

Rule 2a: Use a Long Cryptographically Random Per-User Salt

Rule 2b: Have an additional 'system' salt that is a fixed value for the entire system and it's not stored in the database (better hide it in the source code)

Rule 3: Iterate the hash

Source: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

------

For ASP.NET the only proven option for rule 1 is PBKDF2 which is builtin (http://msdn.microsoft.com/en-us/library/system.security.cryp...)