Flask Session Cookie Signer

About this tool

Flask's default session cookie is signed, not encrypted: the browser can hold the session data, and Flask verifies an HMAC signature before trusting it. This tool builds a compatible value from a JSON object payload and your Flask SECRET_KEY using the same pieces Flask wires into itsdangerous.URLSafeTimedSerializer by default: salt cookie-session, hmac key derivation, SHA-1, compact sorted JSON, and zlib compression only when it makes the payload smaller.

Use it when you need a reproducible cookie for a local test app, a CTF lab, or a migration check. Set timestamp to a fixed Unix time when you want byte-for-byte repeatable output; leave it at 0 to sign with the current clock in the running surface. The result includes the full cookie value, a ready-to-paste Set-Cookie header, each signed segment, the serialized payload, the derived signing key in hex, and cookie-size warnings.

Worked example

Payload:

{"user":1,"admin":true}

Secret: dev-key-123, timestamp: 1700000000, Flask defaults. The output JSON contains a cookie field shaped like:

eyJhZG1pbiI6dHJ1ZSwidXNlciI6MX0.ZVPxAA.<signature>

Copy the cookie value into the session cookie, or use the set_cookie_header field in a local response. If your app uses a different salt, digest, key derivation, cookie name, or byte-encoded secret, set the matching advanced field before signing.

Limits and edge cases

• The payload must be a JSON object string. Use JSON spelling (true, false, null) rather than Python literals (True, False, None).
• Flask tagged types such as bytes, datetimes, tuples, UUIDs, and Markup are not expressible in plain JSON input. Reserved one-key tag dictionaries are escaped so ordinary JSON objects with those keys do not become Flask tagged values by accident.
• Flask's default JSON behavior escapes non-ASCII characters (ensure_ascii = true), and this tool follows that default for byte-for-byte compatibility.
• Cookies over about 4096 bytes are likely to be dropped by browsers; the output includes a warning when name=value exceeds that limit.
• This tool signs a cookie. It does not brute-force secrets, fetch cookies from URLs, or verify an existing cookie against a wordlist.

FAQ