decoder.tools

ViewState (.ASPX) Decoder

Decode an ASP.NET __VIEWSTATE field and read the serialized page state inside it.

Web, API & TokensFree
INPUT
OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A ViewState decoder Base64-decodes the hidden __VIEWSTATE field of an ASP.NET Web Forms page and parses the serialized object tree inside it, showing the control state the page sends back to the server on every postback.

Example

Input
/wEPDwUJNzgzNDMwNTMzZGQ=
Output
Pair
  first: Pair
    first: "783430533"
    second: null
  second: null
Format: ObjectStateFormatter (ff 01)
MAC: none (MAC disabled or stripped)

The decoder reports the ObjectStateFormatter header (ff 01), the size, and how many trailing bytes make up the MAC.

What is ViewState?

ASP.NET Web Forms keeps the state of server controls between requests in a hidden form field:

<input type="hidden" name="__VIEWSTATE" value="/wEPDwUKLTI2…" />

The value is Base64. Inside is a binary serialization (ObjectStateFormatter / LosFormatter) that begins with the bytes ff 01, which is why many ViewState strings start with /wE. It holds control properties, data-bound values and anything a developer put into the ViewState dictionary.

By default ViewState is signed but not encrypted: a MAC (message authentication code) stops tampering, but anyone can read the contents. Developers sometimes store more there than they realise, such as user IDs, prices or internal flags.

How to use the ViewState decoder

  1. Copy the value of the __VIEWSTATE hidden field (you can paste the whole <input …> tag — the value is pulled out for you).
  2. Paste it in. The serialized control tree is shown with its types indented.
  3. Check the MAC line: a tree with no trailing MAC bytes means integrity protection was disabled.

ViewState that starts with something other than /wE is usually encrypted (ViewStateEncryptionMode), and can't be read without the machineKey.

Security notes

  • ViewState MAC must stay on. With enableViewStateMac="false" (forbidden since .NET 4.5.2), or with a leaked machineKey, attackers can craft a ViewState that triggers .NET deserialization and runs code on the server. This is a well-known remote code execution vector.
  • Don't store secrets in ViewState. Unless ViewStateEncryptionMode is Always, the contents are readable by anyone viewing the page source.

ViewState at a glance

Used byASP.NET Web Forms (.aspx pages)
EncodingBase64 of an ObjectStateFormatter stream
Typical prefix/wE (bytes ff 01)
IntegrityHMAC with the machineKey (on by default)
EncryptionOff by default

Frequently asked questions

Can anyone read my ViewState?

Yes, unless encryption is enabled. The MAC only prevents changes. Treat ViewState as readable by every visitor.

Why is my ViewState so large?

Every control with view state enabled stores its properties, and data-bound controls such as GridView can store whole datasets. Disable view state on controls that don't need it (EnableViewState="false").

Does ASP.NET Core use ViewState?

No. ASP.NET Core MVC and Razor Pages have no ViewState. It exists only in classic ASP.NET Web Forms on the .NET Framework.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown