Flask Session Decoder

A Flask session cookie is signed, not encrypted, so its contents are readable without the key: payload.timestamp.signature , base64url, zlib-compressed when the token starts with a dot. Decoding needs no secret. Verifying and signing do, and use itsdangerous's defaults: HMAC-SHA1 with the key derived from the secret and the cookie-session salt.