I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form?

How would I decrypt the cookies?

Are there any tools (akin to Firesheep) that will help with the process?

3 Answers 3


As @blowdart mentioned, the default is to not encrypt the view state (again, I think that was changed in the latest versions).

If you just want to do an audit - set the view state to NOT encrypt (either the default, or manually shut it off), and then you don't need to decrypt it. Then when you're done, you can put view state encryption back on.

Though if you're ensuring there is no sensitive info anyway, you probably don't need the encryption, just set it to signing...

As for tools, try any of these (if its not encrypted):

I also found this question on Stack Overflow.


Assuming you've turned the encryption on, which is not the default, ASP.NET will use the web site machine key as the key used to encrypt and sign ViewState and cookies. As you can set the machine keys (for validation and decryption) to a known value in web.config you could then use this to decrypt manually if necessary.

Configuration also allows you to override which algorithms are used, so you'd need to set those in the web.config as well to get a known starting point.

By default it's 3DES, in ECB with PKCS7 padding, and the viewstate itself is a base 64 string, so from that you'd take the base64 string, convert back to a byte array and then push through a 3DES decrypter to get the data back.

  • I think the algorithms change depending on ASP.NET version.
    – AviD
    Nov 22, 2010 at 7:11
  • Ah, kinda. They added signing with the padding oracle patch. And of course it's all configurable anyway, so you'd need to specifically set an algorithm anyway, just to be sure.
    – blowdart
    Nov 22, 2010 at 14:01
  • Do you have any details on the new signing? I'd like to learn as much as possible Nov 22, 2010 at 16:22
  • It's not been publicly discussed as far as I am aware, so I'm not going to be the first to do it :) Reflector of course would be your friend in this.
    – blowdart
    Nov 22, 2010 at 17:06

Yes this is possible. Refer to https://stackoverflow.com/questions/22814/how-to-decode-viewstate I have provided full source code in there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.