<p>I need to see the contents of the viewstate of an asp.net page. I looked for a viewstate decoder, found <a href="http://www.testingreflections.com/node/view/3424" rel="noreferrer">Fridz Onion's ViewState Decoder</a> but it asks for the url of a page to get its viewstate. Since my viewstate is formed after a postback and comes as a result of an operation in an update panel, I cannot provide a url. I need to copy &amp; paste the viewstate string and see what's inside. Is there a tool or a website exist that can help viewing the contents of viewstate?</p>

[{'answer_id': 22819, 'author': 'Darren Kopp', 'author_id': 77, 'author_profile': 'https://Stackoverflow.com/users/77', 'pm_score': 6, 'selected': True, 'text': '<p>Use <a href="http://www.fiddlertool.com" rel="noreferrer">Fiddler</a> and grab the view state in the response and paste it into the bottom left text box then decode.</p>\n'}, {'answer_id': 22842, 'author': 'Josh Hinman', 'author_id': 2527, 'author_profile': 'https://Stackoverflow.com/users/2527', 'pm_score': 3, 'selected': False, 'text': '<p>As another person just mentioned, it\'s a base64 encoded string. In the past, I\'ve used this website to decode it:</p>\n\n<p><a href="http://www.motobit.com/util/base64-decoder-encoder.asp" rel="noreferrer">http://www.motobit.com/util/base64-decoder-encoder.asp</a></p>\n'}, {'answer_id': 22845, 'author': 'blowdart', 'author_id': 2525, 'author_profile': 'https://Stackoverflow.com/users/2525', 'pm_score': 2, 'selected': False, 'text': '<p>You can ignore the URL field and simply paste the viewstate into the Viewstate string box.</p>\n\n<p>It does look like you have an old version; the serialisation methods changed in ASP.NET 2.0, so grab the <a href="http://www.pluralsight.com/community/media/p/51688.aspx" rel="nofollow noreferrer" title="2.x version">2.0 version</a></p>\n'}, {'answer_id': 22922, 'author': 'Michael Stum', 'author_id': 91, 'author_profile': 'https://Stackoverflow.com/users/91', 'pm_score': 0, 'selected': False, 'text': '<p>Normally, ViewState should be decryptable if you have the machine-key, right? After all, ASP.net needs to decrypt it, and that is certainly not a black box.</p>\n'}, {'answer_id': 4920826, 'author': 'James', 'author_id': 7837, 'author_profile': 'https://Stackoverflow.com/users/7837', 'pm_score': 5, 'selected': False, 'text': '<p>Here\'s an online ViewState decoder:</p>\n\n<p><strike><a href="http://ignatu.co.uk/ViewStateDecoder.aspx" rel="noreferrer">http://ignatu.co.uk/ViewStateDecoder.aspx</a></strike></p>\n\n<p><strong>Edit:</strong> Unfortunatey, the above link is dead - here\'s another ViewState decoder (from the comments):</p>\n\n<p><a href="http://viewstatedecoder.azurewebsites.net/" rel="noreferrer">http://viewstatedecoder.azurewebsites.net/</a></p>\n'}, {'answer_id': 10605023, 'author': 'Sameer Alibhai', 'author_id': 2343, 'author_profile': 'https://Stackoverflow.com/users/2343', 'pm_score': 4, 'selected': False, 'text': '<p>Here is the source code for a ViewState visualizer from <a href="http://msdn.microsoft.com/en-us/library/ms972976.aspx#viewstate_topic11" rel="noreferrer">Scott Mitchell\'s article on ViewState</a> (25 pages)</p>\n\n<pre><code>using System;\nusing System.Collections;\nusing System.Text;\nusing System.IO;\nusing System.Web.UI;\n\n\nnamespace ViewStateArticle.ExtendedPageClasses\n{\n    /// &lt;summary&gt;\n    /// Parses the view state, constructing a viaully-accessible object graph.\n    /// &lt;/summary&gt;\n    public class ViewStateParser\n    {\n        // private member variables\n        private TextWriter tw;\n        private string indentString = "   ";\n\n        #region Constructor\n        /// &lt;summary&gt;\n        /// Creates a new ViewStateParser instance, specifying the TextWriter to emit the output to.\n        /// &lt;/summary&gt;\n        public ViewStateParser(TextWriter writer)\n        {\n            tw = writer;\n        }\n        #endregion\n\n        #region Methods\n        #region ParseViewStateGraph Methods\n        /// &lt;summary&gt;\n        /// Emits a readable version of the view state to the TextWriter passed into the object\'s constructor.\n        /// &lt;/summary&gt;\n        /// &lt;param name="viewState"&gt;The view state object to start parsing at.&lt;/param&gt;\n        public virtual void ParseViewStateGraph(object viewState)\n        {\n            ParseViewStateGraph(viewState, 0, string.Empty);    \n        }\n\n        /// &lt;summary&gt;\n        /// Emits a readable version of the view state to the TextWriter passed into the object\'s constructor.\n        /// &lt;/summary&gt;\n        /// &lt;param name="viewStateAsString"&gt;A base-64 encoded representation of the view state to parse.&lt;/param&gt;\n        public virtual void ParseViewStateGraph(string viewStateAsString)\n        {\n            // First, deserialize the string into a Triplet\n            LosFormatter los = new LosFormatter();\n            object viewState = los.Deserialize(viewStateAsString);\n\n            ParseViewStateGraph(viewState, 0, string.Empty);    \n        }\n\n        /// &lt;summary&gt;\n        /// Recursively parses the view state.\n        /// &lt;/summary&gt;\n        /// &lt;param name="node"&gt;The current view state node.&lt;/param&gt;\n        /// &lt;param name="depth"&gt;The "depth" of the view state tree.&lt;/param&gt;\n        /// &lt;param name="label"&gt;A label to display in the emitted output next to the current node.&lt;/param&gt;\n        protected virtual void ParseViewStateGraph(object node, int depth, string label)\n        {\n            tw.Write(System.Environment.NewLine);\n\n            if (node == null)\n            {\n                tw.Write(String.Concat(Indent(depth), label, "NODE IS NULL"));\n            } \n            else if (node is Triplet)\n            {\n                tw.Write(String.Concat(Indent(depth), label, "TRIPLET"));\n                ParseViewStateGraph(((Triplet) node).First, depth+1, "First: ");\n                ParseViewStateGraph(((Triplet) node).Second, depth+1, "Second: ");\n                ParseViewStateGraph(((Triplet) node).Third, depth+1, "Third: ");\n            }\n            else if (node is Pair)\n            {\n                tw.Write(String.Concat(Indent(depth), label, "PAIR"));\n                ParseViewStateGraph(((Pair) node).First, depth+1, "First: ");\n                ParseViewStateGraph(((Pair) node).Second, depth+1, "Second: ");\n            }\n            else if (node is ArrayList)\n            {\n                tw.Write(String.Concat(Indent(depth), label, "ARRAYLIST"));\n\n                // display array values\n                for (int i = 0; i &lt; ((ArrayList) node).Count; i++)\n                    ParseViewStateGraph(((ArrayList) node)[i], depth+1, String.Format("({0}) ", i));\n            }\n            else if (node.GetType().IsArray)\n            {\n                tw.Write(String.Concat(Indent(depth), label, "ARRAY "));\n                tw.Write(String.Concat("(", node.GetType().ToString(), ")"));\n                IEnumerator e = ((Array) node).GetEnumerator();\n                int count = 0;\n                while (e.MoveNext())\n                    ParseViewStateGraph(e.Current, depth+1, String.Format("({0}) ", count++));\n            }\n            else if (node.GetType().IsPrimitive || node is string)\n            {\n                tw.Write(String.Concat(Indent(depth), label));\n                tw.Write(node.ToString() + " (" + node.GetType().ToString() + ")");\n            }\n            else\n            {\n                tw.Write(String.Concat(Indent(depth), label, "OTHER - "));\n                tw.Write(node.GetType().ToString());\n            }\n        }\n        #endregion\n\n        /// &lt;summary&gt;\n        /// Returns a string containing the &lt;see cref="IndentString"/&gt; property value a specified number of times.\n        /// &lt;/summary&gt;\n        /// &lt;param name="depth"&gt;The number of times to repeat the &lt;see cref="IndentString"/&gt; property.&lt;/param&gt;\n        /// &lt;returns&gt;A string containing the &lt;see cref="IndentString"/&gt; property value a specified number of times.&lt;/returns&gt;\n        protected virtual string Indent(int depth)\n        {\n            StringBuilder sb = new StringBuilder(IndentString.Length * depth);\n            for (int i = 0; i &lt; depth; i++)\n                sb.Append(IndentString);\n\n            return sb.ToString();\n        }\n        #endregion\n\n        #region Properties\n        /// &lt;summary&gt;\n        /// Specifies the indentation to use for each level when displaying the object graph.\n        /// &lt;/summary&gt;\n        /// &lt;value&gt;A string value; the default is three blank spaces.&lt;/value&gt;\n        public string IndentString\n        {\n            get\n            {\n                return indentString;\n            }\n            set\n            {\n                indentString = value;\n            }\n        }\n        #endregion\n    }\n}\n</code></pre>\n\n<p>And here\'s a simple page to read the viewstate from a textbox and graph it using the above code</p>\n\n<pre><code>private void btnParse_Click(object sender, System.EventArgs e)\n        {\n            // parse the viewState\n            StringWriter writer = new StringWriter();\n            ViewStateParser p = new ViewStateParser(writer);\n\n            p.ParseViewStateGraph(txtViewState.Text);\n            ltlViewState.Text = writer.ToString();\n        }\n</code></pre>\n'}, {'answer_id': 15325686, 'author': 'XP1', 'author_id': 412486, 'author_profile': 'https://Stackoverflow.com/users/412486', 'pm_score': 3, 'selected': False, 'text': '<p>JavaScript-ViewState-Parser:</p>\n\n<ul>\n<li><a href="http://mutantzombie.github.com/JavaScript-ViewState-Parser/" rel="noreferrer">http://mutantzombie.github.com/JavaScript-ViewState-Parser/</a></li>\n<li><a href="https://github.com/mutantzombie/JavaScript-ViewState-Parser/" rel="noreferrer">https://github.com/mutantzombie/JavaScript-ViewState-Parser/</a></li>\n</ul>\n\n<blockquote>\n  <p>The parser should work with most non-encrypted ViewStates. It doesn’t\n  handle the serialization format used by .NET version 1 because that\n  version is sorely outdated and therefore too unlikely to be\n  encountered in any real situation.</p>\n</blockquote>\n\n<p><a href="http://deadliestwebattacks.com/2011/05/29/javascript-viewstate-parser/" rel="noreferrer">http://deadliestwebattacks.com/2011/05/29/javascript-viewstate-parser/</a></p>\n\n<hr>\n\n<p><strong>Parsing .NET ViewState</strong></p>\n\n<ul>\n<li><p>A Spirited Peek into ViewState, Part I:</p>\n\n<p><a href="http://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/" rel="noreferrer">http://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/</a></p></li>\n<li><p>A Spirited Peek into ViewState, Part II:</p>\n\n<p><a href="http://deadliestwebattacks.com/2011/05/25/a-spirited-peek-into-viewstate-part-ii/" rel="noreferrer">http://deadliestwebattacks.com/2011/05/25/a-spirited-peek-into-viewstate-part-ii/</a></p></li>\n</ul>\n\n<hr>\n'}, {'answer_id': 15325771, 'author': 'XP1', 'author_id': 412486, 'author_profile': 'https://Stackoverflow.com/users/412486', 'pm_score': 1, 'selected': False, 'text': '<p>Online Viewstate Viewer made by Lachlan Keown:</p>\n\n<p><a href="http://lachlankeown.blogspot.com/2008/05/online-viewstate-viewer-decoder.html" rel="nofollow">http://lachlankeown.blogspot.com/2008/05/online-viewstate-viewer-decoder.html</a></p>\n'}, {'answer_id': 17371001, 'author': 'Basil', 'author_id': 2208657, 'author_profile': 'https://Stackoverflow.com/users/2208657', 'pm_score': 2, 'selected': False, 'text': '<p>This is somewhat "native" .NET way of converting ViewState from string into StateBag\nCode is below:</p>\n\n<pre><code>public static StateBag LoadViewState(string viewState)\n    {\n        System.Web.UI.Page converterPage = new System.Web.UI.Page();\n        HiddenFieldPageStatePersister persister = new HiddenFieldPageStatePersister(new Page());\n        Type utilClass = typeof(System.Web.UI.BaseParser).Assembly.GetType("System.Web.UI.Util");\n        if (utilClass != null &amp;&amp; persister != null)\n        {\n            MethodInfo method = utilClass.GetMethod("DeserializeWithAssert", BindingFlags.NonPublic | BindingFlags.Static);\n            if (method != null)\n            {\n                PropertyInfo formatterProperty = persister.GetType().GetProperty("StateFormatter", BindingFlags.NonPublic | BindingFlags.Instance);\n                if (formatterProperty != null)\n                {\n                    IStateFormatter formatter = (IStateFormatter)formatterProperty.GetValue(persister, null);\n                    if (formatter != null)\n                    {\n                        FieldInfo pageField = formatter.GetType().GetField("_page", BindingFlags.NonPublic | BindingFlags.Instance);\n                        if (pageField != null)\n                        {\n                            pageField.SetValue(formatter, null);\n                            try\n                            {\n                                Pair pair = (Pair)method.Invoke(null, new object[] { formatter, viewState });\n                                if (pair != null)\n                                {\n                                    MethodInfo loadViewState = converterPage.GetType().GetMethod("LoadViewStateRecursive", BindingFlags.Instance | BindingFlags.NonPublic);\n                                    if (loadViewState != null)\n                                    {\n                                        FieldInfo postback = converterPage.GetType().GetField("_isCrossPagePostBack", BindingFlags.NonPublic | BindingFlags.Instance);\n                                        if (postback != null)\n                                        {\n                                            postback.SetValue(converterPage, true);\n                                        }\n                                        FieldInfo namevalue = converterPage.GetType().GetField("_requestValueCollection", BindingFlags.NonPublic | BindingFlags.Instance);\n                                        if (namevalue != null)\n                                        {\n                                            namevalue.SetValue(converterPage, new NameValueCollection());\n                                        }\n                                        loadViewState.Invoke(converterPage, new object[] { ((Pair)((Pair)pair.First).Second) });\n                                        FieldInfo viewStateField = typeof(Control).GetField("_viewState", BindingFlags.NonPublic | BindingFlags.Instance);\n                                        if (viewStateField != null)\n                                        {\n                                            return (StateBag)viewStateField.GetValue(converterPage);\n                                        }\n                                    }\n                                }\n                            }\n                            catch (Exception ex)\n                            {\n                                if (ex != null)\n                                {\n\n                                }\n                            }\n                        }\n                    }\n                }\n            }\n        }\n        return null;\n    }\n</code></pre>\n'}, {'answer_id': 24792458, 'author': 'Roman Starkov', 'author_id': 33080, 'author_profile': 'https://Stackoverflow.com/users/33080', 'pm_score': 3, 'selected': False, 'text': '<p>Here\'s another decoder that works well as of 2014: <a href="http://viewstatedecoder.azurewebsites.net/">http://viewstatedecoder.azurewebsites.net/</a></p>\n\n<p>This worked on an input on which the Ignatu decoder failed with "The serialized data is invalid" (although it leaves the BinaryFormatter-serialized data undecoded, showing only its length).</p>\n'}, {'answer_id': 63395981, 'author': 'henrry', 'author_id': 12780274, 'author_profile': 'https://Stackoverflow.com/users/12780274', 'pm_score': 2, 'selected': False, 'text': '<p>Best way in python is use this <a href="https://pypi.org/project/viewstate/" rel="nofollow noreferrer">link</a>.</p>\n<p>A small Python 3.5+ library for decoding ASP.NET viewstate.</p>\n<p>First install that:   <code>pip install viewstate</code></p>\n<pre><code>&gt;&gt;&gt; from viewstate import ViewState\n&gt;&gt;&gt; base64_encoded_viewstate = \'/wEPBQVhYmNkZQ9nAgE=\'\n&gt;&gt;&gt; vs = ViewState(base64_encoded_viewstate)\n&gt;&gt;&gt; vs.decode()\n(\'abcde\', (True, 1))\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/22814', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/31505/']