Paseto/PASERK Public/Private

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from Paseto/PASERK Public/Private

Paseto/PASERK Public/Private: Generate public/private key pairs and sign/verify payload. PASETO public tokens use asymmetric signatures so a verifier can check authenticity with public material while the signer protects the private key. Cryptographic operations depend on exact agreement about algorithms, keys, encodings, and message formats. A successful local demonstration is useful for understanding a workflow, but interoperability should be checked with the program or protocol that will consume the output. Keep secret material separate from public information and use disposable test keys while experimenting. Encryption, signing, and hashing answer different questions: confidentiality, authenticity, and data representation are not the same property. Record the relevant parameters and verify the reverse operation or verification result before relying on an output.

Guide updated October 13, 2026

How to use this tool

1. Begin with a representative input. For a practical test, use: A disposable public/private pair and a sample payload. Replace demonstration values only after you understand the output.
2. Use sample plaintext and disposable keys to select the operation and supply the key material or parameters requested by the interface.
3. Inspect the result and any error message, checking algorithm choices, key formats, and whether the operation expects public or private material.
4. Test decryption or verification with the intended receiving application and retain the parameters needed to reproduce that workflow.

SEE IT IN PRACTICE

A worked example

A disposable public/private pair and a sample payload

A signed PASETO public token or verification result

Confirm the accepted version, purpose, and claims in the receiving application rather than treating signature validity as complete authorization.

Check purpose and version before interpreting output

A signature binds message bytes to a key under a selected algorithm. A token protocol can add a versioned container and application claims around that operation. PASETO distinguishes local and public purposes, and its version is part of the format. Match the receiving library’s supported purpose, version, and key type rather than choosing based on the appearance of the encoded string.

Cryptographic verification is one decision layer

After verifying a signature or decrypting an authenticated token, the application still needs to evaluate whether the payload is intended for this context. Expiration, audience, issuer policy, and permitted actions are application-level concerns. Test both valid and invalid messages with disposable keys, and keep the trusted verification key or shared key configuration outside the control of an untrusted input token.

When this tool is useful

• Test a signed-token exchange
• Check public-key verification
• Inspect PASERK public/private roles

Tips for a better result

• A signed public token does not inherently hide its payload from readers.
• Public keys may be distributed, while private keys and shared secrets require controlled storage and handling.
• An output that looks like encoded text is not enough to prove compatibility; test it with the actual receiving implementation.

Frequently asked questions