Migrate to Kinde from ASP.NET Identity

Migrate your users from ASP.NET Identity to Kinde. ASP.NET Identity has no built-in export tool, so you export the AspNetUsers table from your database as CSV. User details and password hashes are imported together, so most users keep their existing password with no reset required.

What you need

Link to this section

• A Kinde account with Admin access
• A Kinde account configured to match your current auth provider — see before you migrate
• Read access to your ASP.NET Identity database
• SQL Server Management Studio (SSMS), bcp, or another tool that can export a query result as CSV

Key considerations

Link to this section

• Password hash support — v2 hashes from ASP.NET Identity 2.x on the .NET Framework are supported; v3 hashes are not. See which hash format do I have?.
• CSV format — files must be encoded as UTF-8 or UTF-16 with a byte order mark (BOM). Maximum file size is 49MB. Split larger exports into batches.
• Email, username, and phone identities — the importer reads identity columns from AspNetUsers. External logins such as Google, Microsoft, and Facebook are stored in AspNetUserLogins and are not included.
• Organizations, roles, and permissions are not imported — ASP.NET Identity roles are stored in AspNetRoles and AspNetUserRoles. Use a Custom CSV import or a follow-up import to bring across roles, permissions, or organizations.
• Username case sensitivity — Kinde treats usernames as case-insensitive. Check that usernames remain unique when letter casing is ignored.

Which hash format do I have?

Link to this section

ASP.NET Identity has used two password hash formats. Kinde supports v2.

Format	Produced by	First decoded byte	Supported
v2	ASP.NET Identity 2.x on the .NET Framework	0x00	Yes
v3	ASP.NET Core Identity	0x01	No

A v2 hash is a 49-byte blob: a 0x00 marker, a 16-byte salt, and a 32-byte PBKDF2-HMAC-SHA1 subkey. Its base64 representation is 68 characters and ends in ==. A v3 hash is longer and typically starts with AQAAAA when base64-encoded.

Rows containing v3 or otherwise invalid password hashes are reported as errors and are not imported. To import those users without their passwords, clear the PasswordHash value before importing. They can then set a password the first time they sign in.

Migration guide

Link to this section

1. Export users from ASP.NET Identity

Link to this section

There are two ways to export users from ASP.NET Identity:

• SQL Server Management Studio
• bcp command-line tool

SQL Server Management Studio

Link to this section

1. Go to Tools > Options > Query Results > SQL Server > Results to Grid and turn on Include column headers when copying or saving the results.

2. Open a new query window so the header setting applies.

3. Run this query against your ASP.NET Identity database:

   SELECT
     Id,
     Email,
     EmailConfirmed,
     UserName,
     PhoneNumber,
     PhoneNumberConfirmed,
     PasswordHash
   FROM dbo.AspNetUsers;

   If you extended AspNetUsers with name columns, include FirstName and LastName too.

4. Right-click the results grid and select Save Results As.

5. Save the file as UTF-8 or UTF-16 with a BOM. Available encoding options depend on your SSMS version.

bcp command-line tool

Link to this section

1. Open a command prompt.

2. Run bcp with queryout, a comma field terminator, and -w for UTF-16 or -c -C 65001 for UTF-8. For example:

   bcp "SELECT Id, Email, EmailConfirmed, UserName, PhoneNumber, PhoneNumberConfirmed, PasswordHash FROM dbo.AspNetUsers" queryout users.csv -w -t, -T -S server-name -d database-name

   bcp does not add column headers or quote values that contain commas or line breaks. Add the header row using the same encoding as the data. If your selected fields can contain delimiters, use SSMS or another CSV-aware export tool instead.

Kinde reads these columns:

AspNetUsers column	Used for
Id	Stable external identifier used to match records on re-import
Email	Email identity
EmailConfirmed	Whether the email identity is verified
UserName	Username identity, imported only when it differs from Email
PhoneNumber	Phone identity, imported only when it uses E.164 format
PhoneNumberConfirmed	Whether the phone identity is verified
PasswordHash	ASP.NET Identity v2 password hash
FirstName	Given name, if your schema includes this column
LastName	Family name, if your schema includes this column

Headers can use the PascalCase names above exactly as exported, or their lowercase or snake_case equivalents, such as passwordhash or password_hash. Other columns are ignored.

Your final CSV should look like this:

Id,Email,EmailConfirmed,UserName,PhoneNumber,PhoneNumberConfirmed,PasswordHash
a1b2c3d4-0001,bills@company.com,True,bills@company.com,+61555111555,True,AAARIjNEVWZ3iJmqu8zd7v/vo7NU7QKxVXNpT34wHaq3A//dAREesiNmmrsO8K46cQ==
a1b2c3d4-0002,carlosg@company.com,False,carlosg,,False,AP/u3cy7qpmId2ZVRDMiEQBb0476O+sFgGq7T5oh2MR9HmY+l7xCK+9G0tEmntXYbQ==
a1b2c3d4-0003,lliu@company.com,True,lliu@company.com,,False,

How identities are treated on import

Link to this section

• UserName commonly contains the user’s email address. Kinde creates a separate username identity only when UserName differs from Email, preventing duplicate identities for the same value.
• Phone numbers are imported only when they use E.164 format, with a leading + and country code. ASP.NET Identity does not enforce a format on PhoneNumber, so national-format numbers such as 0555 111 555 are skipped. Normalize them before export if you want to import them.
• Users with an empty PasswordHash, including many external-login users, are imported without a password. They can set one or sign in another way when they first sign in.
• Kinde treats NULL in the PasswordHash column as no password, but in other columns it is treated as a value and can cause validation errors. Check for literal NULL text in the exported file and replace those values with empty fields before importing.

2. Import into Kinde

Link to this section

1. In Kinde, go to Users, then select Import users.

2. Select ASP.NET Identity.

   

3. Follow the on-screen prompts to upload your CSV file (49MB or less).

4. Review any import errors reported after import. Fix the file and re-import to resolve them.

Kinde does not duplicate users with existing identifiers. Records that were already imported and are unchanged are ignored on re-import.

See the bulk import guide for more about file formats and post-import handling.

3. Test the migration

Link to this section

1. Sign in as a user from your ASP.NET Identity export.
2. Verify they can sign in with their existing password.
3. Notify users of changes to their sign-in experience before going live.

Import individual passwords with the API

Link to this section

For a gradual migration, or to catch a user who registered after the export, set an individual user’s password through the Set user password API. Send:

• hashed_password — the PasswordHash value exactly as exported
• hashing_method — aspnet-identity-v2

Do not send salt, salt_position, iterations, or variant. The salt and other parameters are embedded in the hash, so these fields are rejected for this method.

After import

Link to this section

Impact on end users

Link to this section

Importing users and passwords together should mean your users do not notice anything when they next sign in. The first time an imported user signs in, Kinde verifies the password against the ASP.NET Identity hash and re-hashes it with bcrypt. However:

• If a user changes their password after the export and while the migration is in progress, they will need to reset their password in Kinde.
• If you set up a new authentication method, such as passwordless, users will be prompted to use it on sign-in.
• If you add or remove roles or permissions, users may gain or lose access to parts of your system.

Re-importing can update user info

Link to this section

If an imported user starts authenticating through Kinde, a later import containing changes, such as an updated name, updates their Kinde record. Do not use imports for ongoing user management; make later updates through the Kinde admin or Management API instead.

Communication to users

Link to this section

Kinde does not send notifications or invitations when users are imported. The goal is a seamless experience that feels like nothing has changed.

If you changed the sign-in experience, such as adding multi-factor authentication, consider contacting users before the cutover.

Get support

Link to this section

If you need help with your migration, contact Kinde support.