# ViewState (.ASPX) Decoder

> Decode an ASP.NET __VIEWSTATE field and read the serialized page state inside it.

- Page: https://decoder.tools/viewstate-decoder
- Category: Web, API & Tokens
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A ViewState decoder Base64-decodes the hidden `__VIEWSTATE` field of an ASP.NET Web Forms page and parses the serialized object tree inside it, showing the control state the page sends back to the server on every postback.

## Example

```text Input
/wEPDwUJNzgzNDMwNTMzZGQ=
```

```text Output
Pair
  first: Pair
    first: "783430533"
    second: null
  second: null
Format: ObjectStateFormatter (ff 01)
MAC: none (MAC disabled or stripped)
```

The decoder reports the ObjectStateFormatter header (ff 01), the size, and how many trailing bytes make up the MAC.

## What is ViewState?

ASP.NET Web Forms keeps the state of server controls between requests in a hidden form field:

```html
<input type="hidden" name="__VIEWSTATE" value="/wEPDwUKLTI2…" />
```

The value is Base64. Inside is a binary serialization (`ObjectStateFormatter` / `LosFormatter`) that begins with the bytes `ff 01`, which is why many ViewState strings start with `/wE`. It holds control properties, data-bound values and anything a developer put into the `ViewState` dictionary.

By default ViewState is **signed but not encrypted**: a MAC (message authentication code) stops tampering, but anyone can read the contents. Developers sometimes store more there than they realise, such as user IDs, prices or internal flags.

## How to use the ViewState decoder

1. Copy the value of the `__VIEWSTATE` hidden field (you can paste the whole `<input …>` tag — the value is pulled out for you).
2. Paste it in. The serialized control tree is shown with its types indented.
3. Check the MAC line: a tree with no trailing MAC bytes means integrity protection was disabled.

ViewState that starts with something other than `/wE` is usually encrypted (`ViewStateEncryptionMode`), and can't be read without the `machineKey`.

## Security notes

- **ViewState MAC must stay on.** With `enableViewStateMac="false"` (forbidden since .NET 4.5.2), or with a leaked `machineKey`, attackers can craft a ViewState that triggers .NET deserialization and runs code on the server. This is a well-known remote code execution vector.
- **Don't store secrets in ViewState.** Unless `ViewStateEncryptionMode` is `Always`, the contents are readable by anyone viewing the page source.

## ViewState at a glance

| | |
|---|---|
| Used by | ASP.NET Web Forms (.aspx pages) |
| Encoding | Base64 of an `ObjectStateFormatter` stream |
| Typical prefix | `/wE` (bytes `ff 01`) |
| Integrity | HMAC with the `machineKey` (on by default) |
| Encryption | Off by default |

## FAQ

### Can anyone read my ViewState?

Yes, unless encryption is enabled. The MAC only prevents changes. Treat ViewState as readable by every visitor.

### Why is my ViewState so large?

Every control with view state enabled stores its properties, and data-bound controls such as `GridView` can store whole datasets. Disable view state on controls that don't need it (`EnableViewState="false"`).

### Does ASP.NET Core use ViewState?

No. ASP.NET Core MVC and Razor Pages have no ViewState. It exists only in classic ASP.NET Web Forms on the .NET Framework.