Keys, Certificates & Tokens
Flask Session Verifier
Process key or token data with Flask Session Verify and explicit format settings. Enter the key material, choose the required format, then review the result.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
Flask Session Verifier performs Flask-style cookie integrity verification for the supplied key or certificate data. It checks the HMAC and returns valid: true with the JSON payload and optional timestamp, or throws an error.
It checks the HMAC and returns valid: true with the JSON payload and optional timestamp, or throws an error. This result runs in the browser for this catalog category. Processing runs in the browser.
A valid HMAC does not establish current login status, user permissions, or session freshness.
Instructions
- Provide text or data for this tool.
- Paste payload.timestamp.signature without HTTP cookie attributes. This applies to Flask Session Verifier.
- Inspect the timestamp separately from application session policy. This applies to Flask Session Verifier.
Example
Input: Use the complete three-part cookie from a disposable Flask Session Sign run with its matching key and salt.
Settings: Flask Session Verifier: Match Algorithm sha1 or sha256 and the original Salt. View TimeStamp controls whether the decoded timestamp appears in the returned object.
Result: It checks the HMAC and returns valid: true with the JSON payload and optional timestamp, or throws an error.
Limits
- Flask Session Verifier: The parser requires exactly three segments and does not support compressed cookies with an extra leading dot.
- Flask Session Verifier: It reports a timestamp but does not enforce a maximum session age.