The Base64 decode will throw an exception if the string is not a proper Base64 decoding. Also, even if it did work, the cookies would be invalidated due to the change from HmacSHA1 to HmacSHA256. If you prefer, I could make it more backwards compatible. One way would be to deprecate SecureCookier and add a new class that uses the new key format and Hmac.