PASETO

PASETO Public and Local Tokens Do Not Solve Session Revocation

A PASETO token can protect claims cryptographically without knowing whether the user has logged out. That boundary matters more than the usual JWT-versus-PASETO comparison: changing the token format does not create session revocation. PASETO gives each token an explicit version and purpose. With Version 4, v4.public signs a message with Ed25519, while v4.local encrypts and authenticates a message with symmetric cryptography. Those choices determine who can read a token and who can create or verify it. They do not determine whether a previously valid token should still be accepted after a session changes.