I'm doing a password manager for a school project and I need to hash the master password for verification but I also need to write the hashing algorithm myself. However, most the algorithms I've come across are very complicated (except for MD5 but that's overly insecure). Are there any slightly simpler hashing alogorithms which won't take too long to write and implement without libraries? (I'm using c#).
The PBKDF2 construction is simple to implement, and can be implemented with any underlying hash function.
Unlike modern password hash functions, the end result will be computationally intensive, but won't have any resistance against parallelization. Not requiring much memory means that ASICs can efficiently brute-force passwords hashed that way.
Balloon hashing is nearly as simple to implement as PBKDF2 and is a memory-hard password hash (like Argon2 or scrypt). Balloon is also specifically recommended as a memory-hard password hash in the latest revision of NIST SP-800-63B so that might net some extra consideration from your instructors if this is an applied crypto class. (Dealing with compliance and standards is an important part of real-world cryptography practice).
Balloon is defined for any cryptographic hash function, so you can implement with C#’s included SHA256 and then implement SHA256 itself if time permits.
Pay careful attention to making constant-time comparisons of secret-derived data (such as when verifying the master password). I suspect this is what your instructor really wants to see. Also zero secrets from memory as quickly as possible after they are used.
except for MD5 but that's overly insecure
So MD5 would be fine if it was secure? The reason MD5 is considered insecure is because it is highly vulnerable to collision attacks, which involve creating two differing inputs that have the same hash. The only attack that would be relevant to password hashing is a preimage attack, and MD5 is not vulnerable to these. So why is MD5 (and even SHA-1 and SHA-2) not safe to use to hash passwords? Simple: It's too fast. A fast GPU can try literally billions of candidate passwords per second.
Luckily for you, it is possible to slow down MD5! There are several different constructions which can do this, the most popular being PBKDF2. However there are even more simple constructions. The S2K KDF from the OpenPGP standard is by far one of the most simple password hashing algorithms which uses a fast hash. All it involves is passing a repetition of the password and a salt through the fast hash function until several tens or hundreds of megabytes have been processed.
Note that even though this will be more secure than a plain hash, you still shouldn't use this for anything more than a toy project. S2K is not memory-hard, which means an attacker can use massive parallelism to their advantage. Memory-hard KDFs like Argon2 are not nearly as easy to implement.