Machine Key Generator Net 4.5


This tool will generate a valid random machine key used by ASP.NET for encryption, decryption, validation of forms-authentication and view-state data, and other purposes. Select your target version of ASP.NET and click the Generate Keys button.

The implementation of the <machineKey> element in ASP.NET is replaceable. This allows most calls to ASP.NET cryptographic routines to be routed through a replacement data protection mechanism, including the new data protection system.


Package installation


The new data protection system can only be installed into an existing ASP.NET application targeting .NET 4.5.1 or later. Installation will fail if the application targets .NET 4.5 or lower.

To install the new data protection system into an existing ASP.NET 4.5.1+ project, install the package Microsoft.AspNetCore.DataProtection.SystemWeb. This will instantiate the data protection system using the default configuration settings.

When you install the package, it inserts a line into Web.config that tells ASP.NET to use it for most cryptographic operations, including forms authentication, view state, and calls to MachineKey.Protect. The line that's inserted reads as follows.


You can tell if the new data protection system is active by inspecting fields like __VIEWSTATE, which should begin with 'CfDJ8' as in the example below. 'CfDJ8' is the base64 representation of the magic '09 F0 C9 F0' header that identifies a payload protected by the data protection system.

Package configuration

The data protection system is instantiated with a default zero-setup configuration. However, since by default keys are persisted to the local file system, this won't work for applications which are deployed in a farm. To resolve this, you can provide configuration by creating a type which subclasses DataProtectionStartup and overrides its ConfigureServices method.

Below is an example of a custom data protection startup type which configured both where keys are persisted and how they're encrypted at rest. It also overrides the default app isolation policy by providing its own application name.


You can also use <machineKey applicationName='my-app' ... /> in place of an explicit call to SetApplicationName. This is a convenience mechanism to avoid forcing the developer to create a DataProtectionStartup-derived type if all they wanted to configure was setting the application name.

To enable this custom configuration, go back to Web.config and look for the <appSettings> element that the package install added to the config file. It will look like the following markup:

Fill in the blank value with the assembly-qualified name of the DataProtectionStartup-derived type you just created. If the name of the application is DataProtectionDemo, this would look like the below.

The newly-configured data protection system is now ready for use inside the application.

Machine -->


Provides a way to encrypt or hash data (or both) by using the same algorithms and key values that are used for ASP.NET forms authentication and view state.


Key Generator Download


Machine Key Generator .net 4.5

The MachineKey class provides methods that expose the hashing and encryption logic that ASP.NET provides. For information about which encryption and hashing algorithms ASP.NET uses, and the key values that it uses with them, see machineKey Element (ASP.NET Settings Schema).


The MachineKey APIs should only be used in an ASP.NET app. Behavior of the MachineKey APIs outside the context of an ASP.NET application is undefined


Decode(String, MachineKeyProtection)

Decodes and/or validates data that has been encrypted or provided with a hash-based message authentication code (HMAC).

Encode(Byte[], MachineKeyProtection)

Encrypts data and/or appends a hash-based message authentication code (HMAC).

Protect(Byte[], String[])

Protects the specified data by encrypting or signing it.

Unprotect(Byte[], String[])

Unprotects the specified data, which was protected by the Protect(Byte[], String[]) method.

Applies to