diff --git a/Web.Tests/Utility/CryptoTests.cs b/Web.Tests/Utility/CryptoTests.cs
index cbd676f..95e97d4 100644
--- a/Web.Tests/Utility/CryptoTests.cs
+++ b/Web.Tests/Utility/CryptoTests.cs
@@ -1,4 +1,5 @@
-using MileageTraker.Web.Utility;
+using System;
+using MileageTraker.Web.Utility;
 using NUnit.Framework;
 
 namespace Web.Tests.Membership
@@ -22,5 +23,19 @@ namespace Web.Tests.Membership
 			bool verifyHashedPassword = Crypto.VerifyHashedPassword(hashPassword, password);
 			Assert.IsTrue(verifyHashedPassword);
 		}
+
+		[Test]
+		public void VerifyHashPassword_NotBase64Hash_Test()
+		{
+			bool verifyHashedPassword = Crypto.VerifyHashedPassword("notbase64", "not a password");
+			Assert.IsFalse(verifyHashedPassword);
+		}
+
+		[Test]
+		[ExpectedException(typeof(ArgumentNullException))]
+		public void VerifyHashPassword_NullHash_Test()
+		{
+			Crypto.VerifyHashedPassword(null, "not a password");
+		}
 	}
 }
diff --git a/Web/Utility/Crypto.cs b/Web/Utility/Crypto.cs
index 61ed17b..a1e0dce 100644
--- a/Web/Utility/Crypto.cs
+++ b/Web/Utility/Crypto.cs
@@ -47,7 +47,16 @@ namespace MileageTraker.Web.Utility
 			if (password == null)
 				throw new ArgumentNullException("password");
 
-			var hashedPasswordBytes = Convert.FromBase64String(hashedPassword);
+			byte[] hashedPasswordBytes;
+			
+			try
+			{
+				hashedPasswordBytes = Convert.FromBase64String(hashedPassword);
+			}
+			catch (FormatException)
+			{
+				return false;
+			}
 
 			// Verify a version 0 (see comment above) password hash.