Documentation
¶
Overview ¶
Package paseto decodes (and, for the Ed25519 public variants, verifies) PASETO tokens — "Platform-Agnostic Security Tokens", the modern signed/encrypted token format positioned as the safer alternative to JWT (no algorithm confusion, versioned crypto). It is the PASETO counterpart of jwt_decode for the web-token decode stack: an operator pastes a token captured from an Authorization header / cookie / API body and gets its structure and — for the public (signed, not encrypted) variants — the cleartext claims, without a PASETO library. Pure offline transform; no network or device.
A PASETO token is `version.purpose.payload[.footer]` (base64url, unpadded):
- **public** (signed, NOT encrypted): the payload is the cleartext message followed by a signature, so the claims are recoverable without any key (exactly like jwt_decode reads a JWT body). Signature sizes: v2/v4 Ed25519 = 64 bytes, v3 ECDSA P-384 = 96 bytes, v1 RSA-PSS = 256 bytes.
- **local** (encrypted): the payload is nonce ‖ ciphertext ‖ tag; without the symmetric key only the structure is visible, so it is surfaced as length + hex with a note (no claims are recoverable).
Wrap-vs-native judgement ¶
Native. Decoding is base64url + a length split; Ed25519 verification is crypto/ed25519 over the PASETO Pre-Authentication Encoding (PAE) — both standard library. Adding github.com/o1c-dev/paseto or aidantwoods/go-paseto as a runtime dependency to read untrusted tokens is unwarranted, consistent with internal/jwtsig and the other in-tree token/crypto packages.
Verifiable / no confidently-wrong output ¶
Strongest verification class — anchored to the official PASETO test vectors (github.com/paseto-standard/test-vectors): v4.public 4-S-1 decodes to its exact cleartext claims and Verify returns true with its published public key (and false for a tampered token); 4-S-2's footer decodes; the v4.local 4-E-1 payload is surfaced encrypted, never guessed. A malformed token (wrong part count, bad base64url, payload shorter than the signature) is rejected with an error.
Covered / deferred ¶
Covered: structural decode of all four versions (v1–v4) × both purposes, the public cleartext message, and Ed25519 signature verification for the v2/v4 public variants. Deferred: v1 (RSA-PSS) and v3 (ECDSA P-384) signature verification (different algorithms; v4 is the current recommendation) and local decryption (requires the symmetric key and is out of scope for a decode tool).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Verify ¶
Verify checks an Ed25519 public-token signature (v2 / v4 only) against the given hex-encoded 32-byte public key. implicit is the optional implicit assertion (v3/v4; pass "" if none). It returns whether the signature is valid. Decoding the claims does not require this — Verify is the authenticity check.
Types ¶
type Result ¶
type Result struct {
Version string `json:"version"`
Purpose string `json:"purpose"`
// Public (signed) tokens — cleartext message + signature.
Message string `json:"message,omitempty"`
MessageHex string `json:"message_hex,omitempty"` // set when message is not valid UTF-8
SignatureHex string `json:"signature_hex,omitempty"`
// Local (encrypted) tokens — opaque payload.
EncryptedHex string `json:"encrypted_payload_hex,omitempty"`
EncryptedBytes int `json:"encrypted_payload_bytes,omitempty"`
Note string `json:"note,omitempty"`
}
Result is the decoded view of a PASETO token.
Source Files