FLASK SESSION DECODER.

Paste any Flask/Werkzeug session token. Base64, zlib, timestamps - all handled client-side.

// INPUT
[0 chars]

What is Flask Unsign?

Flask Unsign is a free, open-source online tool for decoding Flask session cookies. Flask and Werkzeug use a specific signed cookie format to store session data on the client side. This tool lets you paste any Flask session token and instantly decode the base64-encoded payload, detect zlib compression, extract embedded timestamps, and visualize the full JSON session data - all without sending anything to a server.

How Does Flask Session Cookie Decoding Work?

Flask session cookies are base64url-encoded, optionally zlib-compressed, and signed with an HMAC. The cookie format consists of a payload, timestamp, and cryptographic signature separated by dots. Flask Unsign parses this structure, decodes the base64url payload, decompresses it if the leading byte indicates zlib compression, and then deserializes the JSON data for inspection. The signature is displayed but cannot be verified without the secret key.

Why Use This Tool?

  • 100% Client-Side - Your session tokens never leave your browser. No data is transmitted to any server.
  • No Installation Required - Unlike the flask-unsign CLI tool, this works directly in your browser.
  • Security Research - Essential for penetration testing, CTF challenges, and web application security auditing.
  • Instant Results - Paste a cookie and see the decoded payload immediately with syntax-highlighted JSON.
  • Detailed Inspection - View compression status, timestamp, payload size, number of keys, and signature hash.

Frequently Asked Questions

Is this the same as the flask-unsign Python package?

This is a browser-based alternative to the popular flask-unsign Python CLI tool. While the CLI tool can also brute-force secret keys and sign cookies, this web tool focuses on decoding and inspecting session payloads without needing Python installed.

Is it safe to paste my session cookie here?

Yes. This tool runs entirely in your browser using JavaScript. No data is sent to any server - you can verify this by checking the network tab in your browser's developer tools, or by reviewing the open-source code on GitHub.

What Flask session formats are supported?

Flask Unsign supports all standard Flask/Werkzeug session cookie formats including uncompressed base64url payloads, zlib-compressed payloads (prefixed with a dot), and cookies with or without timestamp/signature sections.

Can this tool crack or forge Flask session cookies?

No. This tool only decodes the unsigned payload. It cannot brute-force the secret key or forge valid signatures. For signing and brute-forcing, use the flask-unsign CLI tool.