Skip to content
BetterPass logo

PASETO Encoder, Decoder & Key Generator

Create v4.local (encrypted) and v4.public (signed) tokens, generate Ed25519 keypairs and 32-byte symmetric keys, and decode v2/v4 tokens — entirely in your browser.

Version and purpose (v4.public / v4.local) are auto-detected. v1 and v3 tokens show why they aren't supported.
Paste a token to decode it. v2 and v4 are supported; v1 and v3 are detected and explained.

What is PASETO?

PASETO (Platform-Agnostic Security Tokens) is a modern token format designed as a safer alternative to JWT. Each version pins a fixed, opinionated set of cryptographic primitives per purpose, so there is no algorithm negotiation to attack.

v4.public — signed tokens using Ed25519. Anyone can read the payload, but only the holder of the secret key can sign.
v4.local — encrypted tokens using XChaCha20-Poly1305. The payload is confidential and authenticated.
No algorithm confusion — the version and purpose are part of the token string itself (`v4.public.` / `v4.local.`), so attacks like `alg:none` or RS256-to-HS256 key confusion are impossible by construction.

Create, sign, encrypt, decode, and verify PASETO tokens — entirely in your browser.

Zero-Server Tool Data Guarantee

All PASETO encoding, decoding, encryption, signing, and key generation happens entirely in your browser with the Web Crypto random number generator. Tokens and keys are never sent to any server.

How to Use

01

Choose version & purpose

Pick v4 (recommended). Use v4.public for signed tokens anyone can read, or v4.local for encrypted tokens that hide the payload.

02

Enter payload & footer

Paste a JSON payload (it's minified automatically) and optionally add a footer with a kid for key identification.

03

Provide or generate keys

Paste an existing key or generate one with the Random key / Keypair buttons — the matching public key is derived for you.

04

Encode & verify

Copy the token, then switch to the Decode tab with the same key to confirm it round-trips correctly.

05

Paste an existing token

Drop in a v2 or v4 token — the version and purpose are auto-detected, and v1/v3 tokens explain why they're unsupported.

06

Provide the key to verify or decrypt

For public tokens, add the Ed25519 public key to verify the signature. For local tokens, add the 32-byte symmetric key to decrypt the payload.

Common Use Cases

API Authentication

Replace JWTs with signed PASETO tokens for stateless API auth. The Ed25519 signature provides strong authenticity without algorithm negotiation risks.

Encrypted Session Data

Encrypt session claims into v4.local tokens so the payload stays confidential while the kid footer tells the server which key to use.

Secure Communication

Exchange encrypted PASETO tokens between services as a lightweight, self-contained encrypted message format.

Key Provisioning

Generate Ed25519 keypairs and 32-byte symmetric keys for local development, then move them into your real key management system.

Audit & Debugging

Decode a token from production to check the payload, footer, and kid, and confirm the signature or encryption is still valid.

Audit Trail Logging

Sign log entries with v4.public to create tamper-evident audit trails that can be verified long after creation.

Implementation Examples

JavaScriptCreate & Verify v4.public
// Install: npm install paseto
const paseto = require('paseto');
const { Signer, Verifier } = paseto.V4;


async function example() {
    // Generate an Ed25519 keypair
    const secretKey = await Signer.generate();
    const publicKey = await Verifier.generate();


    // Sign a v4.public token, carrying the key ID in the footer
    const token = await Signer.sign(
        { sub: 'user123', role: 'admin' },
        secretKey,
        { footer: '{"kid":"signing-key-1"}', expiresIn: '1h' }
    );
    console.log('v4.public:', token);


    // Verify (footer must match)
    const payload = await Verifier.verify(token, publicKey, { footer: '{"kid":"signing-key-1"}' });
    console.log('Verified:', payload);
}

PASETO versions

VersionSigned (public)Encrypted (local)Status
v1RSA (RSASSA-PSS)AES-128-CTR + HMAC-SHA384Legacy — avoid
v2Ed25519XChaCha20-Poly1305Deprecated — avoid
v3Ed448AES-256-CTR + HMAC-SHA384NIST-compatible
v4Ed25519XChaCha20-Poly1305Recommended

PASETO vs JWT

FeaturePASETO v4JWT (JWS/JWE)
Algorithm choiceFixed per purpose (safe)Flexible (risky)
EncryptionXChaCha20-Poly1305Depends on header (often AES-CBC)
SigningEd25519 (EdDSA)RS256, ES256, HS256, etc.
Algorithm confusion attacksImpossible by designCommon vulnerability
Token sizeCompact (binary payload)Larger (Base64 JSON)
Ecosystem maturityGrowing (smaller community)Massive (industry standard)
Header/kid supportFooter fieldkid header parameter
Library availabilityGood (JS, Python, Go, Rust)Excellent (every language)
alg:none / unverified headerNot possible — purpose is fixedHistoric vulnerability

Production Best Practices & Security

Default to v4 — it uses the most modern primitives (Ed25519 and XChaCha20-Poly1305). v2 shares those primitives but is formally deprecated; v1 uses legacy RSA/AES-128 primitives and v3 uses NIST primitives (Ed448, AES-256-CTR) that aren't available in the browser.
Put key IDs in the footer — carry `kid` in the unencrypted footer so verifiers know which key to use, and rotate keys regularly. Why:rotation limits the blast radius of a compromised key, and the footer is the designed place for key identification.
Never put secrets in the footer — the footer is authenticated but visible in `v4.local` tokens. Why:anyone who holds the token can read the footer even though they can't decrypt the payload.
Sign v4.public tokens only with non-confidential payloads — signed tokens are readable by anyone. Why:only v4.local provides confidentiality; a v4.public payload is public knowledge.
Store symmetric keys in a KMS or HSM — never hardcode v4.local keys in source. Why:anyone with the key can decrypt every past and future v4.local token.
Always verify signatures server-side — a decoded token isn't necessarily authentic; verification is the only proof of origin.

Frequently Asked Questions

PASETO (Platform-Agnostic Security Tokens) is a token format designed as a secure alternative to JWT and JOSE.

Unlike JWT, which lets you choose from many algorithms (including insecure options like none or alg:none), PASETO uses versioned protocols with fixed, modern cryptographic primitives per version. This eliminates algorithm confusion attacks, weak algorithm selection, and other common JWT vulnerabilities.

PASETO tokens have a simple structure: version (like v4), purpose (local for encryption or public for signatures), and the encoded payload.