{"id":27744,"library":"flask-unsign","title":"Flask Unsign","description":"Penetration testing tool to decode and brute-force Flask session cookies by testing against a wordlist of common secret keys. Current version: 1.2.1. Release cadence is irregular, with the last release in 2022.","status":"active","version":"1.2.1","language":"python","source_language":"en","source_url":"https://github.com/Paradoxis/Flask-Unsign","tags":["flask","security","pentest","session-cookie","brute-force"],"install":[{"cmd":"pip install flask-unsign","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Required for Flask session format handling","package":"flask","optional":false}],"imports":[{"wrong":"from flask_unsign import UnsignSession","symbol":"Cracker","correct":"from flask_unsign import Cracker"},{"symbol":"decode","correct":"from flask_unsign import decode"},{"symbol":"sign","correct":"from flask_unsign import sign"}],"quickstart":{"code":"from flask_unsign import UnsignSession\n\n# Decode a session cookie (no secret needed)\ncookie = 'eyJ1c2VyIjoiYWRtaW4ifQ.XYZ...'\nunsign = UnsignSession()\nprint(unsign.decode(cookie))\n\n# Brute-force secret key using a wordlist\nwordlist = ['secret', 'key', 'password']\nresult = unsign.unsign(cookie, wordlist=wordlist)\nprint(f\"Secret found: {result}\" if result else \"Not found\")","lang":"python","description":"Decode a Flask session cookie or brute-force its secret key using a wordlist."},"warnings":[{"fix":"Read the wordlist file into a list before passing: wordlist = [line.strip() for line in open('wordlist.txt')]","message":"UnsignSession.unsign() expects a wordlist as a list of strings. Passing a file path will fail silently.","severity":"gotcha","affected_versions":"<=1.2.1"},{"fix":"Use requests or another library to fetch cookies, then pass the cookie value to flask-unsign.","message":"The tool does not support custom HTTP headers or proxies; it only extracts the session cookie string.","severity":"gotcha","affected_versions":"<=1.2.1"},{"fix":"Use the Python API with UnsignSession class.","message":"The command-line interface (flask-unsign --decode) is still available but not actively maintained. The Python API is preferred.","severity":"deprecated","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'1.2.1':26 '2022':36 'brute':10,44 'brute-forc':9,43 'cadenc':28 'common':21 'cooki':14,42 'current':24 'decod':7 'flask':1,12,37 'forc':11,45 'irregular':30 'key':23 'last':33 'penetr':3 'pentest':39 'releas':27,34 'secret':22 'secur':38 'session':13,41 'session-cooki':40 'test':4,16 'tool':5 'unsign':2 'version':25 'wordlist':19","created_at":"2026-05-09T05:51:51.549690+00:00","updated_at":"2026-05-09T05:51:51.549690+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"flask-unsign","cli_version":"1.2.1","type":"library","homepage":null,"github":"https://github.com/Paradoxis/Flask-Unsign","docs":null,"changelog":null,"pypi":"https://pypi.org/project/flask-unsign/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","web-framework"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":null}}