diff --git a/dec_token.py b/dec_token.py
new file mode 100644
index 0000000..46c890a
--- /dev/null
+++ b/dec_token.py
@@ -0,0 +1,29 @@
+def decode_token(username, token, masterpassword):
+
+    # decode the token from hex to bytes
+    decoded_token = bytes.fromhex(token)
+
+    unsername_from_token = bytearray()
+    for i in range(32):
+        unsername_from_token.append(decoded_token[i] ^ ord(masterpassword[i]))
+
+    # remove padding
+    unsername_from_token = unsername_from_token.rstrip(':'.encode())
+    print("Username from token:", unsername_from_token.decode())
+
+    return unsername_from_token.decode() == username
+
+
+if __name__ == "__main__":
+
+    token = input("Enter your token: ")
+    username = input("Enter your username: ")
+    masterpassword = input("Enter your masterpassword (32 characters): ")
+    if len(masterpassword) != 32:
+        print("Masterpassword must be 32 characters long")
+        exit(1)
+
+    if decode_token(username, token, masterpassword):
+        print("Token is valid")
+    else:
+        print("Token is invalid")