Click here to Skip to main content
15,115,411 members
Articles / Web Development / ASP.NET
Posted 4 Dec 2006


121 bookmarked

ASP.NET machineKey Generator

Rate me:
Please Sign up or sign in to vote.
4.81/5 (23 votes)
4 Dec 20065 min read
A machineKey generator allowing static keys in ASP.NET 1.1 or 2.0 applications.

Sample Image - machineKey.png


Whenever you make use of ViewState, Session, Forms authentication, or other encrypted and/or secured values, ASP.NET uses a set of keys to do the encryption and decryption. Normally, these keys are hidden and automatically generated by ASP.NET every time your application recycles, but there are times when you want to specify a particular, persistent key. This article will explain why hard-coded machineKeys are good, and how to generate random ones for ASP.NET 1.1 or 2.0.

Why you Want a Persistent Key

There are two keys that ASP.NET uses to encrypt, decrypt, and validate data in ViewState, Forms Authetication tickets, and out-of-process Session data. The decryptionKey is used for encryption and decryption of authentication tickets and encrypted ViewState information. The validationKey is used to validate ViewState and ensure it hasn't been tampered with, and generate unique application-specific session IDs for out-of-process session storage.

You can run into problems if the key changes between postbacks, e.g., if the keys used to generate the ViewState information are different from one page to the next. If that happens, the ViewState validation will fail (because the validationKey after postback will be different from what was used pre-postback) and the user will get an Invalid_ViewState error. Different keys across postback can also mean that your Forms Authentication tickets will fail, requiring users to log back into your application; out-of-process session information will be lost (since the session IDs will change); and encrypted ViewState information will be unable to be decrypted and read.

Lastly, if you want to use encrypted passwords with ASP.NET 2.0's Membership provider, you have to provide a static key, or else you'll get a You must specify a non-autogenerated machine key to store passwords in the encrypted format error.

Why Would the Key Change?

Keys can change across postbacks more often than you'd expect. One way is if you're running a web farm. By default, the validationKey used to create the MAC is randomly generated by ASP.NET when the application pool starts up. This ensures that the validation key is unique and changes periodically. However, since the key is different from server to server, if you're viewing a page on Server A and post it to Server B, when Server B generates a MAC based on the viewstate data, that value won't match the MAC value when the page was initially served by Server A. Thus, you'll get an Invalid_Viewstate error.

Another reason the validationKey and decryptionKey (and thus the MAC) will be different is if you cross application pools. If you view a page running in pool A, and post to another page on pool B (e.g., through Server.Transfer), the keys will be different & you'll get a mismatch.

Lastly, the validationKey and decryptionKey can change mid-session for users if the application pool restarts. Assume some user is viewing a page on your site and filling out a form. While they're doing that, some sysadmin restarts the pool, thus generating a new key. When the user posts the page, they'll get an Invalid_Viewstate error. The application can also restart if it is set to shut down while idle (the default is to shut down pools that have been idle for 20 minutes). Imagine a user who views a page on your site, goes away for 10 minutes, then maybe spends 20 minutes filling in the form on the page. Meanwhile, no one else is on your site, so the application pool times out & shuts down. When the user finally posts the form (30 minutes after viewing it), the application pool will start back up, create a new validation key, generate a new MAC, notice that the MAC values don't match, and reward your user's diligence with an Invalid_Viewstate error.

Where to Put the Key

So if you want to create a static set of keys, you'll need to put it in the machineKey block in either the machine.config or web.config. You can read more about the machineKey element on MSDN.

The validationKeys are a maximum of 64 bytes long. In ASP.NET 1.1, the encryption algorithm was 3DES along with a maximum 24 byte decryptionKey. ASP.NET 2.0 provided an attribute called decryption allowing the user to specify the hashing algorithm used for decrypting data. The AES algorithm is the best choice, and accommodates a 32 byte decryptionKey.

Please note that the below examples contain [...] to indicate that some characters were removed for readability. The actual values of the keys are long, unbroken hex-encoded strings. Don't copy & paste the below examples verbatim into your web.config -- instead, download and run the sample project, or generate random keys via the online demo.

ASP.NET 1.1 version:


ASP.NET 2.0 version:

validation="SHA1" decryption="AES"

Generating Random Keys

Now that we've discussed the keys in the machineKey section, let's take a quick peek at some code to randomly generate keys. It's pretty simple.

The below function accepts a number of bytes, uses the .NET Crypto library to generate a byte array of random numbers, and StringBuilder to build and return a hex-encoded string. Since the random numbers are hex-encoded, a 24 byte random key will produce a 48 character hex-encoded string.

public string getRandomKey(int bytelength)
    byte[] buff = new byte<bytelength>;
    RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
    StringBuilder sb = new StringBuilder(bytelength * 2);
    for (int i = 0; i < buff.Length; i++)
        sb.Append(string.Format("{0:X2}", buff[i]));
    return sb.ToString();

Now we have two simple functions that use the getRandomKey function to build and return a complete machineKey section that can be pasted into a web.config.

public string getASPNET20machinekey()
    StringBuilder aspnet20machinekey = new StringBuilder();
    string key64byte = getRandomKey(64);
    string key32byte = getRandomKey(32);
    aspnet20machinekey.Append("<machineKey \n");
    aspnet20machinekey.Append("validationKey=\"" + key64byte + "\"\n");
    aspnet20machinekey.Append("decryptionKey=\"" + key32byte + "\"\n");
    aspnet20machinekey.Append("validation=\"SHA1\" decryption=\"AES\"\n");
    return aspnet20machinekey.ToString();

public string getASPNET11machinekey()
    StringBuilder aspnet11machinekey = new StringBuilder();
    string key64byte = getRandomKey(64);
    string key24byte = getRandomKey(24);

    aspnet11machinekey.Append("<machineKey ");
    aspnet11machinekey.Append("validationKey=\"" + key64byte + "\"\n");
    aspnet11machinekey.Append("decryptionKey=\"" + key24byte + "\"\n");
    return aspnet11machinekey.ToString();

Now all we have to do is call the getASPNET11machinekey or getASPNET20machinekey functions to get back a random machineKey section for the environment of our choice.

The Sample Application

The sample application is an ASP.NET 1.1 Web Project that contains a machineKey.aspx file demonstrating the above functionality. You can also see a live demo here if you want to generate keys yourself or just see how it works.


We've discussed the decryptionKey and validationKey, reviewed how they can change and what problems that can cause, and discussed how to generate and deploy static keys to avoid problems. Hopefully that will help you next time you run into ViewState or other related problems.

Related Reading

You can read more about machineKey and its impact at:


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Ben Strackany
United States United States
Ben Strackany is a freelance IT Consultant specializing in Microsoft development and web site planning, scalability, and hosting. He is the head of DevelopmentNow, a Portland-based technology consulting company.

Comments and Discussions

QuestionASP.NET machineKey Generator Pin
Member 1393887511-Aug-18 6:09
MemberMember 1393887511-Aug-18 6:09 
GeneralMy vote of 3 Pin
AbdullaMohammad30-Jul-12 0:58
MemberAbdullaMohammad30-Jul-12 0:58 
Questioncopy Pin
Emirhan Özeren10-Jul-12 13:26
MemberEmirhan Özeren10-Jul-12 13:26 
GeneralCopy of article Pin
Member 135152922-Feb-10 17:02
MemberMember 135152922-Feb-10 17:02 
AnswerRe: Copy of article Pin
Jan Steyn9-Mar-13 5:38
MemberJan Steyn9-Mar-13 5:38 
AnswerWhere is date? Pin
QMasters3-Dec-14 0:46
professionalQMasters3-Dec-14 0:46 
QuestionEnough secure? Pin
Idsa30-Mar-08 3:49
MemberIdsa30-Mar-08 3:49 
GeneralConfiguring machineKey Pin
Idsa30-Mar-08 0:14
MemberIdsa30-Mar-08 0:14 
GeneralProblem using static machine keys Pin
sadaniel24-Apr-07 10:58
Membersadaniel24-Apr-07 10:58 
GeneralRe: Problem using static machine keys Pin
Ben Strackany24-Apr-07 18:12
MemberBen Strackany24-Apr-07 18:12 
GeneralRe: Problem using static machine keys Pin
sadaniel25-Apr-07 3:52
Membersadaniel25-Apr-07 3:52 
GeneralRe: Problem using static machine keys Pin
Ben Strackany1-May-07 12:14
MemberBen Strackany1-May-07 12:14 
GeneralWebGarden... Pin
Luc Bardez4-Apr-07 3:33
MemberLuc Bardez4-Apr-07 3:33 
GeneralRe: WebGarden... Pin
Ben Strackany5-Apr-07 7:00
MemberBen Strackany5-Apr-07 7:00 
GeneralCongratulations Ben!! Pin
Muammar©29-Jan-07 21:18
Member Muammar©29-Jan-07 21:18 
GeneralRe: Congratulations Ben!! Pin
Ben Strackany31-Jan-07 6:32
MemberBen Strackany31-Jan-07 6:32 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.