Encode fernet

Encrypt and authenticate a short message as a Fernet token.

freeworks offlinenothing uploaded
ToolFernet Encoder
Input
Output
—

How it works

Fernet signs and encrypts a versioned token containing a timestamp, random IV, ciphertext, and HMAC tag; AES-CBC with PKCS7 padding protects the plaintext and HMAC-SHA256 authenticates the complete token fields. The key is split into signing and encryption halves.

  • A timestamp supports TTL checks and encrypt-then-MAC detects tampering.

Worked example

Encrypt API credentials for config
Generate a Fernet token encrypting sensitive data with an auto-generated key
Input
											db_password=Kx9!mP2$vL&7qR
Output
												Token: gAAAAABqjY5bs8WT5OOLmq9LVX1asy4zi_gPjOqCPqXeBc-MrK-v2bsM-ZxCKGqwf9uXZd-ls5Da_JVPj7csqY8rBEyZi3cESODehdYBV6rzOUoYkwMcrOw=
Key: rCt4LSGZRjMN0PJiBC1eDfdjfsU82DJ4N9JdH3LxZeE=
Note: Fernet token generated with AES-128-CBC encryption and HMAC-SHA256 authentication.

When to use this

Encrypted cookies, background-job payloads, and TTL test fixtures use Fernet tokens.

Edge cases

  • Changing one token byte invalidates the HMAC.
  • A token can be valid yet expired by TTL policy.
  • Fresh random IVs are required for repeated plaintexts.

References