---
id: flask-unsign
version: "1.2.1"
license: MIT
license_treatment: permissive
maintenance: dormant
---

# flask-unsign — Flask Unsign is a penetration testing utility that attempts to uncover a Flask server's secret key by taking a signed session verifying it against a wordlist of commonly used and publicly known secret keys (sourced from books, GitHub, StackOverflow and various other sources).

License: permissive · Maintenance: dormant · Downloads: 101.2K/mo

## What it is and what it does

Flask-Unsign is a penetration testing utility designed to test Flask application security by attempting to recover or forge session cookies. It decodes Flask's signed (but not encrypted) session data, brute-forces the server's secret key against wordlists of common keys, and can craft new session cookies once a key is found. The tool operates as a command-line utility and depends on Flask, itsdangerous, and related web framework libraries.

The package is intended for authorized security testing and development environments. It reads session cookies from HTTP responses or accepts them directly, then attempts to match the signature against a wordlist of known or guessed secret keys. Once a match is found, you can generate new signed session data with arbitrary content. The tool includes options for handling older itsdangerous versions (--legacy flag) and custom wordlist formats.

Use it for:

- Test your own Flask application's session security by attempting to recover the secret key with common wordlists.
- Decode and inspect Flask session data during development and debugging without knowing the secret key.
- Authorized penetration testing to verify whether a Flask server uses weak or publicly known secret keys.
- Forge custom session cookies to test authorization logic and access control in Flask applications.
- Verify that session management is properly implemented before deploying a Flask application to production.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Command-line tool to decode, brute-force, and forge Flask session cookies by attempting to guess or verify the server's secret key against wordlists.

Yes, if you are conducting authorized security testing or developing Flask applications and need to verify session security. The low install friction and permissive license make it accessible. However, maintenance is dormant (last release 619 days ago), so expect no active support; use it for one-off testing rather than as a dependency in production code. Not suitable for general-purpose use outside security testing contexts.

## Install

pip install flask-unsign
uv add flask-unsign
poetry add flask-unsign

## Installing flask-unsign

Before you install: Low install friction with a pure-Python wheel. Maintenance is dormant—last release was 619 days ago, though the repository remains active with a recent commit on 2024-12-03. Suitable for one-off testing but not for ongoing development.

License in practice: MIT license is permissive; you can use, modify, and distribute this tool freely in commercial and private projects with minimal restrictions, provided you retain the license notice.

Quickstart:

pip install flask-unsign
flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOmZhbHNlfQ.XDuWxQ.E2Pyb6x3w-NODuflHoGnZOEpbH8'
flask-unsign --unsign --cookie < cookie.txt

Requires Python 3.6 or later. Wordlist-based brute-forcing requires a newline-delimited wordlist file or the optional [wordlist] extra.

Verify before relying:

- Whether the tool works reliably against modern Flask/itsdangerous versions without the --legacy flag.
- Performance characteristics when brute-forcing against large wordlists on typical hardware.
- Compatibility with Flask applications using custom session serialization or signing algorithms.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: dormant
- Downloads: 101.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask session cookie decoder, brute force flask secret key, flask cookie unsigner, penetration testing flask sessions, forge flask session cookies, flask security testing tool, decode signed flask cookies, penetration-testing, flask-security, session-management

[View on SkillFed](https://skillfed.io/packages/flask-unsign) · [View on PyPI](https://pypi.org/project/flask-unsign/)