Keys, Certificates & Tokens
Flask Session Decoder
Process key or token data with Flask Session Decode and explicit format settings. Enter the key material, choose the required format, then review the result.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
Flask Session Decoder performs Flask session processing for the supplied key or certificate data. The operation returns a signed session value, decoded session data, or verification status.
The operation returns a signed session value, decoded session data, or verification status. This result runs in the browser for this catalog category. Processing runs in the browser.
Session signing protects integrity under a shared secret; it does not provide complete authentication or session management.
Instructions
- Provide text or data for this tool.
- Use public fixture data and a disposable secret. This applies to Flask Session Decoder.
- Verify the signed value with the same serializer and secret. This applies to Flask Session Decoder.
- Check session expiry and server-side authorization separately. This applies to Flask Session Decoder.
Example
Input: A public test session value with secret "not-production".
Settings: Flask Session Decoder: Use the exact Flask session format expected by the operation. Provide the signing secret for sign or verify operations. Keep serializer and digest settings compatible with the source application.
Result: The operation returns a signed session value, decoded session data, or verification status.
Limits
- Flask Session Decoder: Decoding does not prove a session was issued by the application.
- Flask Session Decoder: A valid signature does not replace session expiry or account checks.
- Flask Session Decoder: Never paste production session secrets or cookies into a shared tool.