You can put a webconfig inside of a specific directory to control authorization for that particular directory.  You can also use <location> tags in the main web.config to get the same result.  I'm not sure about having each subdirectory have it's own login page.  You could try setting the loginUrl="Login.aspx" on the forms auth tag, so that it is pointed releative to the webconfig.

Yes. You can user your own algorithm, but when you use standard , proven one then it will be much safer.

 Hi,

we can always decrypt the password by the encrypt-decrypt method we using.
So in forgot password case,we can apply decrypt method to send same password.

 Hi,

Ignore my answer.

what is the use of Decrypting the password.

You can generate the new passowrd guid Guid or random no. and the use Substring() to takes its some character ans then encrypt it and update the old password with this new password.

Then send that substring() value the user.

He can change it later.

how can I encrypt the querystring like gmail. means the value should be long like gmail. i also have to decrypt later on the other page.

Thanks in advance