Decode PASETO

Inspect the version, purpose, payload, and footer of a PASETO token.

freeworks offlinenothing uploaded
ToolPASETO Decoder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The token is split into version, purpose, payload, and optional footer fields according to PASETO’s dot-separated format, then the payload and footer are decoded. Local decoding does not verify a public-mode signature or decrypt a local-mode token without the correct key.

  • PASETO separates public signatures from local encryption through its purpose field.

Worked example

Inspect v4.public token with key ID footer
Decode a PASETO v4 public token to see its version, purpose, and footer metadata
Input
											v4.public.eyJzdWIiOiJ1c2VyLTEyMyIsImV4cCI6IjIwMjUtMDEtMDFUMDA6MDA6MDBaIn0.eyJraWQiOiJrZXktMDAxIn0
Output
												PASETO Token Analysis
Version: v4
Purpose: public
Payload (encoded): eyJzdWIiOiJ1c2VyLTEyMyIsImV4cCI6IjIwMjUtMDEtMDFUMD...
Footer: {"kid":"key-001"}

Note: Public tokens are signed but not encrypted. Verification requires the public key.

When to use this

JWT migrations, support tickets, and v4.public fixture checks inspect PASETO tokens.

Edge cases

  • A v4.public token is not interchangeable with a v4.local token.
  • A footer is authenticated metadata, not the payload itself.
  • Readable encoded bytes do not prove a valid signature.

References