Is ViewState encrypted?

Not by default — it is Base64-encoded and MAC-signed, which protects integrity but not confidentiality. Anyone can read it unless ViewStateEncryptionMode is enabled.

Why is ViewState a security topic?

Because it is deserialized server-side. If an attacker learns the machine key (from a leaked web.config, for example), they can forge a valid ViewState and trigger .NET deserialization gadgets — a documented path to remote code execution.

Can I disable ViewState?

Yes, per control or per page with EnableViewState="false". Most modern ASP.NET applications avoid Web Forms entirely, which removes the field altogether.

ViewState (.ASPX) Decoder

Base64-decode ASP.NET __VIEWSTATE and inspect its serialized structure.

on the roadmapWeb, API & Tokensfree · no sign-up

This bench is being wired up

The viewstate-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the ViewState (.ASPX) Decoder?

A ViewState decoder Base64-decodes the ASP.NET __VIEWSTATE field and parses the LosFormatter/ObjectStateFormatter binary structure inside it, revealing the serialized control state a page round-trips through the browser.

ASP.NET Web Forms keeps page state in a hidden field called __VIEWSTATE. It is a serialized object graph — control properties, data-bound values, sometimes far more than the developer realised — Base64-encoded and sent to the client on every request. It is not encrypted by default; it is signed with a MAC derived from the machine key.

That makes ViewState interesting from both sides. For developers it explains page bloat and postback bugs. For security testers it is a well-known deserialization attack surface: a leaked or predictable machine key allows a forged ViewState to reach a .NET deserializer, which has historically meant remote code execution. Reading the structure is the first step in either investigation.

ViewState (.ASPX) Decoder at a glance

Field: Hidden input named __VIEWSTATE
Encoding: Base64 over a LosFormatter binary graph
Integrity: MAC from the machineKey — not encryption by default
Risk: Deserialization RCE when the machine key leaks

How to use the ViewState (.ASPX) Decoder

1Copy the __VIEWSTATE value out of the page source or the POST body.
2Paste it in to Base64-decode the payload and inspect its byte structure.
3Look for readable strings and type markers to understand what state is being round-tripped.

When you would reach for it

Explaining why an ASP.NET page ships hundreds of kilobytes on every request.
Checking whether sensitive values are being persisted into client-side state.
Assessing ViewState MAC and machine key configuration during a pentest.

ViewState (.ASPX) Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools