I'm trying to study how to safely store users (username and password) in my database.

From what I've gathered on my research, the safest way to store a password is:

• Generate Salt
• Concat Salt on the password
• Hash the concatenated result into SHA-256
• Iterate on it (should be 640.000 iterations if I got it right, but I'm not sure)

I found the class Rfc2898DeriveBytes which allows me to do that, but now I'm not sure how to store all the data in my database, my question is how am I going to do a login if the hashed password is always different?

Rfc2898DeriveBytes generates a key, but I'm pretty sure that I should not save the key in the database, I don't know what do :(

For now this is what I wrote/gathered:

    public static byte[] GetSalt(int maximumLenght)
    {
        byte[] salt = new byte[maximumLenght];

        using (var random = new RNGCryptoServiceProvider())
        {
            random.GetNonZeroBytes(salt);
        }

        return salt;
    }
    public byte[] GenerateSaltedHash(byte[] password, byte[] salt)
    {
        byte[] concatenatedSalt = new byte[salt.Length + password.Length];
        concatenatedSalt = salt.Concat(password).ToArray();

        return settings.HashAlgorithmType.ComputeHash(concatenatedSalt);
    }

    public static byte[] HashPassword(byte[] password, byte[] salt, int iterations)
    {
        using (var rfc2898 = new Rfc2898DeriveBytes(password, salt, iterations))
        {
            //dunno to do with that
            return rfc2898.GetBytes(32);
        }
    }

I should store the iteration count, salt and the hash? It is safe to do that?