The __VIEWSTATE hidden field is used to transfer the differences in controls from what is declared in the page — and the values they contain at the end of a request immediately prior to rendering. We can then use this information to re-construct the server controls to match that last rendered state during ‘postbacks’ to a page.
The information within the __VIEWSTATE field is not really encrypted — although the values are definitely ‘cyptic’ to read (mainly because server controls try to store information in as compact a format as possible — and because our serializer performs some limited compression).
You can see how much viewstate each control is saving by enabling tracing for the page. For example, by adding a trace attribute to the page directive:
<%@ Page Language=\\'VB\\' Trace=\\'True\\' %>
This will cause a table to be output at the bottom of the page. This won’t show the exact values stored in viewstate — but will give you a rough estimate of the size of each server control value.
Note that you can disable the viewstate feature — either for the entire page or on specific server controls. This is done at the page level by setting the following page directive:
<%@ Page Language=\\'VB\\' MaintainState=\\'False\\' %>
or on an individual server control by setting a ‘maintainstate’ attribute: