It is a client side state management .For maintaining page level state. it is in intercepted format and in hidden field.

1. ViewState is the mechanism ASP.NET uses to keep track of server control state values that don’t otherwise post back as part of the HTTP form. ViewState Maintains the UI State of a Page
ViewState is base64-encoded. It is not encrypted but it can be encrypted by setting EnableViewStatMAC=”true” & setting the machineKey validation type to 3DES. If you want to NOT maintain the ViewState, include the directive < %@ Page EnableViewState="false" % > at the top of an .aspx page or add the attribute EnableViewState=”false” to any control.