The __VIEWSTATE hidden field is used to transfer the differences in controls from what is declared in the page -- and the values they contain at the end of a request immediately prior to rendering. We can then use this information to re-construct the server controls to match that last rendered state during "postbacks" to a page.
The information within the __VIEWSTATE field is not really encrypted -- although the values are definitely "cyptic" to read (mainly because server controls try to store information in as compact a format as possible -- and because our serializer performs some limited compression).
You can see how much viewstate each control is saving by enabling tracing for the page. For example, by adding a trace attribute to the page directive:
This will cause a table to be output at the bottom of the page. This won’t show the exact values stored in viewstate -- but will give you a rough estimate of the size of each server control value.
Note that you can disable the viewstate feature -- either for the entire page or on specific server controls. This is done at the page level by setting the following page directive:
or on an individual server control by setting a "maintainstate" attribute: