Beyond JWT: Why PASETO and Branca Are the Future of Secure Tokens

JSON Web Token (JWT) has been the de facto standard for stateless authentication for many years. However, their widespread acceptance exposed serious security flaws, weak signature conclusions, and confusion attacks against accidental abuse. In this deep dive, we will explore why JWT is fundamentally dangerous despite its popularity.

Enter PASETO (Platform-Agnostic SEcurity TOkens) and Branca, two modern token formats designed to eliminate JWT’s vulnerabilities while maintaining simplicity. In this deep dive, we’ll explore:

• Why JWT is fundamentally risky despite its popularity.
• How PASETO enforces secure-by-default cryptography.
• When Branca’s simplicity beats PASETO for encrypted tokens.
• Step-by-step migration from JWT to these alternatives.

1. The Problem with JWTs

The JWTS issues are flexible. However, this flexibility leads to risk. This is how things don’t work: 

A. Algorithm Confusion Attacks

JWTs let attackers switch from asymmetric (e.g., RS256) to symmetric (HS256) signing, tricking servers into accepting forged tokens.

Exploit Scenario:

1. A server expects RS256 (public-key verification).
2. The attacker changes the header to HS256 and signs with the public key (now treated as an HMAC secret).
3. The server validates the token using its own public key as the HMAC key—granting access.

Code Vulnerability:

// Danger: Libraries often auto-verify using the ‘alg’ header  

jwt.verify(token, publicKey); // If ‘alg’ is HS256, publicKey becomes HMAC key!

B. Weak Signing Keys

• Short HS256 secrets are brute-forceable.
• Accidental use of a non-algorithm (yes, some libraries allowed this).

C. No Built-in Encryption

• The encrypted person will decode the payload and not risk removing data leakage.

2. PASETO: Secure by Design

PASETO (RFC draft-paragon-paseto-rfc-02) kills JWT’s pitfalls by:

• Fixing algorithm confusion: No alg header—crypto is versioned (e.g., v2.public).
• Mandating solid cryptography: only vetted algorithms (e.g., Ed25519, AES-256-GCM).
• Structured payloads: No vague parsing.

PASETO vs. JWT

Feature	JWT	PASETO
Algorithm Choice	User-selectable (risky)	Version-locked (secure)
Default Security	Weak (HS256 allowed)	Strong (Ed25519 or AES-256-GCM)
Encryption	Optional (JWE)	Built-in (v2.local)

Generating a PASETO Token (Node.js)

const paseto = require('paseto.js');  
const { V2 } = paseto;  
const privateKey = await V2.generateKey('public');  
const token = await V2.sign(  
  	{ userId: 123, role: 'admin' },  
  	privateKey,  
  	{ expiresIn: '1h' }  
);  

console.log(token); // v2.public.eyJ1c2VySWQiOjEyMywicm9sZSI6ImFkbWluIn0…

Verifying a PASETO Token

const publicKey = privateKey.publicKey();  

const payload = await V2.verify(token, publicKey); // Throws if invalid 

Why This Works:

• No alg header  implies no algorithm switching.
• v2.public continuously uses Ed25519 (cutting-edge elliptic-curve marking).

3. Branca: Encrypted Tokens Made Simple

Branca is an encrypted alternative to JWT:

• Always encrypted (AES-256-GCM).
• Smaller overhead than JWE (JSON Web Encryption).

Use Case: Internal microservices where payload secrecy is required.

Generating a Branca Token

const Branca = require(‘branca’);  

const branca = Branca(‘supersecretkey32charslong!’);  

const token = branca.encode(JSON.stringify({ userId: 123 }));  

console.log(token); // XEaDFuGj…

Decrypting a Branca Token

const payload = branca.decode(token);  

console.log(JSON.parse(payload)); // { userId: 123 } 

Key Advantage: No need to manage signing keys—just a shared secret.

4. Relocation Direct: From JWT to PASETO/Branca

When to Select PASETO:

• Public APIs (require asymmetric verification).
• Regulated environments (audit-friendly crypto).

When to Choose Branca:

• Internal administrations (less difficult  key management).
• Encrypted payloads (no isolated JWE setup).

Step-by-Step Migration (Node.js)

1. Replace JSON Web Token with paseto.js or branca.
2. Rotate keys: Invalidate old JWTs.
3. Update clients: Guarantee they support PASETO/Branca.

5. When Should You Still Utilize JWT?

• Legacy frameworks  with hardcoded JWT logic.
• Third-party integration requiring JWTs (e.g., OAuth).

Conclusion

JWTs are dangerously flexible, while PASETO and Branca enforce security by design.

• PASETO for signed, auditable tokens.
• Branca for encrypted, inside tokens.

Actionable Takeaway:

• Audit your JWT utilization nowadays for algorithm confusion risks.
• Migrate high-security frameworks  to PASETO first.

“Security shouldn’t be optional—stop using JWTs like it’s 2015.”