Signed Cookie Decode
Verify and parse a signed cookie from Express (cookie-signature), Flask (itsdangerous), or Rails. Splits on the framework-specific separator, recomputes the HMAC under your secret, and reports valid + payload. Constant-time compare so timing can't lift the signature.
About Signed Cookie Decode
Signed Cookie Decode verifies and parses a signed cookie from Express (cookie-signature), Flask (itsdangerous), or Rails. It splits on the framework's separator, recomputes the HMAC under the secret you provide, and reports whether the signature is valid along with the decoded payload. The comparison is constant-time so the signature can't be guessed through timing, and the whole process runs in your browser.
- Category
- inspect
- Input
- Accepts: */*.
- Output
- Outputs: application/json.
- Cost
- Free, runs in your browser
- Memory
- low
Common uses
- Confirm a session cookie from your Express app is signed correctly while debugging auth
- Decode a Flask itsdangerous session to inspect the flash messages and user id it carries
- Check whether a Rails signed cookie validates under a rotated secret_key_base
- Diagnose why a request is being rejected by seeing if the cookie's HMAC actually matches
- Verify that a tampered cookie reported by a security scan really fails signature validation
- Read the payload of a third-party signed cookie to understand its structure before integrating
Frequently asked questions
Which frameworks are supported?
Express (cookie-signature), Flask (itsdangerous), and Rails. The tool knows each one's separator and signing scheme.
Do I need the signing secret?
Yes, to verify the HMAC. Provide the same secret your app uses, and the tool reports whether the signature is valid.
Is my secret sent to a server?
No. Verification runs entirely in your browser, so the secret and cookie never leave your device, which matters because the secret is sensitive.
Why does it use a constant-time compare?
Comparing the recomputed and provided signatures in constant time prevents timing attacks that could otherwise leak the correct signature byte by byte.
What does it return?
JSON with a valid flag and the decoded payload, so you can see both whether the cookie is trustworthy and what it contains.
Keywords
- cookie
- session
- signed
- verify
- express
- flask
- rails
- itsdangerous
- hmac