Why aren\'t these the same?
php:
$hash = hash(\'sha256\', $userData[\'salt\'] . hash(\'sha256\', $password) );
c#
Because they're different. Your C# code encodes the computed hash in Base64 encoding at the end. PHP just returns a string of hexadecimal digits.