How to view information in ViewState using ASP.NET 2.0 and 3.5

Posted by: Suprotim Agarwal , on 2/18/2008, in Category ASP.NET
Views: 87850
Abstract: ViewState is a Base64 encoded string and is not readable by the human eye. However it is also not difficult to decode the viewstate and view the contents of the viewstate when it is passed over the wire. In this article we will see how to decode and view the contents of a viewstate.
How to view information in ViewState using ASP.NET 2.0 and 3.5
Http is a stateless protocol. Hence the state of controls is not saved between postbacks. Viewstate is the means of storing the state of server side controls between postbacks. Viewstate stores the state of controls in HTML hidden fields. In other words, it is a  snapshot of the contents of a page.
When set to True, the ‘EnableViewState’ property enables storing the state of an object in a page between postbacks. Objects are saved in a Base64 encoded string. Because it is a Base64 encoded string, it is not readable by the human eye. However it is also not difficult to decode the viewstate and view the contents of the viewstate when it is passed over the wire. In this article we will see how to decode and view the contents of a viewstate.
Step 1: Create an application with 2 textboxes, a label and a button as shown below. On the button click, we will concatenate the values of the 2 textbox and display this information in the label control.
    <form id="form1" runat="server">
        <asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>
        <br />
        <br />
        <asp:TextBox ID="TextBox2" runat="server"></asp:TextBox>
        <br />
        <br />
        <asp:Label ID="Label1" runat="server"></asp:Label><br />
        <br />
        <asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="Button" />
        <br /> </div>
Step 2: Add the button click event:
protected void Button1_Click(object sender, EventArgs e)
        Label1.Text = TextBox1.Text + " " + TextBox2.Text;     
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As EventArgs)
      Label1.Text = TextBox1.Text & " " & TextBox2.Text
End Sub
Step 3: Execute the page and enter some values in the textbox. We will enter the value ‘I Love’ and ‘’ respectively in the two textboxes. Now click the button. The label will contain the concatenated value and should display ‘I Love’. Now right click on the page > View Source.
Along with the other html text, you will see the following:
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJODczNjQ5OTk0D2QWAgIDD2QWAgIFDw8WAh4EV
/6kXnY15AUSAwa" />
Step 4: Shown above in the blue colored text is the viewstate. This is the Base64 encoded string which we will be decoding. Do the following. Add another textbox and button control on to the page. Rename the textbox to ‘txtViewState’ and set its ‘TextMode’ property to ‘Multiline’. Set the text property of the button control to ‘View ViewState’ as shown below:

<br />View State<br />

<asp:TextBox ID="txtViewState" runat="server" TextMode="MultiLine" Width="667px"></asp:TextBox><br />

<asp:Button ID="Button2" runat="server" OnClick="Button2_Click" Text="View ViewState" />

On the button click add the following code.
protected void Button2_Click(object sender, EventArgs e)
        byte[] decode = Convert.FromBase64String(txtViewState.Text);
        txtViewState.Text = System.Text.Encoding.ASCII.GetString(decode);
Protected Sub Button2_Click(ByVal sender As Object, ByVal e As EventArgs)
            Dim decode As Byte() = Convert.FromBase64String(txtViewState.Text)
            txtViewState.Text = System.Text.Encoding.ASCII.GetString(decode)
End Sub
Step 5: Repeat Step 3. Copy the blue colored text and paste it in the ‘txtViewState’ textbox. Now click on the second button ‘View ViewState’. You will see that the decoded viewstate is displayed in the textbox as shown below:
?       873649994d[1][1] d[1][1][1] TextI Love DotnetCurry.comddd???I?????y???H
Even though there are junk characters displayed in the textbox, however you can make out that the textbox contained the word ‘I Love’
Well that was simple, wasn’t it? In the coming articles we will see how to encrypt viewstate in order to prevent its contents to be decoded. I hope this article was useful and I thank you for viewing it.
 If you liked the article,  Subscribe to my RSS Feed. 

This article has been editorially reviewed by Suprotim Agarwal.

Absolutely Awesome Book on C# and .NET

C# and .NET have been around for a very long time, but their constant growth means there’s always more to learn.

We at DotNetCurry are very excited to announce The Absolutely Awesome Book on C# and .NET. This is a 500 pages concise technical eBook available in PDF, ePub (iPad), and Mobi (Kindle).

Organized around concepts, this Book aims to provide a concise, yet solid foundation in C# and .NET, covering C# 6.0, C# 7.0 and .NET Core, with chapters on the latest .NET Core 3.0, .NET Standard and C# 8.0 (final release) too. Use these concepts to deepen your existing knowledge of C# and .NET, to have a solid grasp of the latest in C# and .NET OR to crack your next .NET Interview.

Click here to Explore the Table of Contents or Download Sample Chapters!

What Others Are Reading!
Was this article worth reading? Share it with fellow developers too. Thanks!
Share on LinkedIn
Share on Google+

Suprotim Agarwal, MCSD, MCAD, MCDBA, MCSE, is the founder of DotNetCurry, DNC Magazine for Developers, SQLServerCurry and DevCurry. He has also authored a couple of books 51 Recipes using jQuery with ASP.NET Controls and The Absolutely Awesome jQuery CookBook.

Suprotim has received the prestigious Microsoft MVP award for Sixteen consecutive years. In a professional capacity, he is the CEO of A2Z Knowledge Visuals Pvt Ltd, a digital group that offers Digital Marketing and Branding services to businesses, both in a start-up and enterprise environment.

Get in touch with him on Twitter @suprotimagarwal or at LinkedIn

Page copy protected against web site content infringement 	by Copyscape

Feedback - Leave us some adulation, criticism and everything in between!
Comment posted by amal on Wednesday, February 20, 2008 7:01 AM
It is nice article
Comment posted by Vijayeta Sinha on Sunday, February 24, 2008 5:41 AM
I am trying this code but it does not work.  Always I am getting the junk caracters like ????????????? ???????c?????x?I ?U ?   c??N? only.
Comment posted by Suprotim Agarwal on Monday, February 25, 2008 12:13 PM
Hi Vijayeta, Make sure you are not using the ViewStateEncryptionMode="Always" in your page or web.config.
Comment posted by syed on Thursday, February 28, 2008 11:07 AM
MIND BLOWING>>>>>>>> I GOT IT........ I really liked the code..thnx a ton
Comment posted by chandra prakash on Tuesday, April 1, 2008 10:35 AM
i am satisfied to read this article  and  as my concern i am given it six out of ten
Comment posted by anil on Thursday, April 10, 2008 9:29 AM
i am getting this error. PLs teel me solution

Invalid character in a Base-64 string.

        byte[] decode = Convert.FromBase64String(TextBox3.Text);
        TextBox3.Text = System.Text.Encoding.ASCII.GetString(decode);
Comment posted by Hegibase64 on Friday, September 5, 2008 11:13 AM
It was to poor. For lame develeoper it would be enough to "decode it as a base64". Perhaps some more insight in viewstate structure and "what does mean all that magic characters" section would improve this for a great articlce. But now only 2/10
Comment posted by Suprotim Agarwal on Friday, September 5, 2008 10:58 PM
Hegibase64: Thanks for your comments. Writing about viewstate is a good idea and I will cover it in the forthcoming articles.
Comment posted by unruledboy on Tuesday, September 9, 2008 6:06 AM
check this out:

Comment posted by Imran on Tuesday, September 9, 2008 9:00 AM
Nice post but is there anything which supports large number of data and work with .net 3.5 and displays everything.
Comment posted by Kent Lau on Monday, September 28, 2009 3:50 AM
I follow your example in Visual Web Developer 2008 Express Edition and it works.
Thank you.
Comment posted by sdfgsdfgdsfg on Tuesday, October 27, 2009 12:48 AM
<script> alert('test')</script>
Comment posted by Amit on Wednesday, March 17, 2010 1:32 AM
Nice article
Comment posted by nikhil on Wednesday, March 31, 2010 9:15 AM
its not working.invalid length for Base64.
Comment posted by madhusudan on Thursday, April 8, 2010 4:49 PM
the way to understanding is to good,,,,,,,,,,,
Comment posted by gf on Monday, April 19, 2010 8:24 AM
Comment posted by Sabir attar on Wednesday, January 26, 2011 11:15 PM
Thanx .. nice article
Comment posted by Kapil Singh on Thursday, November 17, 2011 3:45 AM
I was reading your article and I would like to appreciate you for making it very simple and understandable. This article gives me a basic idea of view state in and it will help me a lot. I have found another nice post which also explain nicely viewstate in, you may visit that post by clicking on following link...

Thanks Everyone!!
Comment posted by dsg on Tuesday, June 26, 2012 11:10 AM
    nfnfn dfbdfnfdnfd ffh