{"id":13415016,"url":"https://github.com/daviddesmet/paseto-dotnet","last_synced_at":"2026-07-03T23:01:10.308Z","repository":{"id":39441873,"uuid":"125129269","full_name":"daviddesmet/paseto-dotnet","owner":"daviddesmet","description":"🔑 Paseto.NET, a Paseto (Platform-Agnostic Security Tokens) implementation for .NET","archived":false,"fork":false,"pushed_at":"2026-07-03T21:44:30.000Z","size":2054,"stargazers_count":147,"open_issues_count":10,"forks_count":11,"subscribers_count":5,"default_branch":"master","last_synced_at":"2026-07-03T22:23:12.487Z","etag":null,"topics":["dotnet","dotnet-core","netstandard","paseto"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/daviddesmet.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["daviddesmet"],"custom":["https://paypal.me/daviddesmet"]}},"created_at":"2018-03-13T23:50:33.000Z","updated_at":"2026-07-03T21:42:57.000Z","dependencies_parsed_at":"2024-01-05T20:51:33.966Z","dependency_job_id":"2bf3ae17-8e04-4ad7-a3c8-459eb000aae5","html_url":"https://github.com/daviddesmet/paseto-dotnet","commit_stats":{"total_commits":167,"total_committers":10,"mean_commits":16.7,"dds":0.6107784431137724,"last_synced_commit":"738e953f80ded0bd8c047f2527f6e3f452122d8e"},"previous_names":["idaviddesmet/paseto-dotnet"],"tags_count":17,"template":false,"template_full_name":null,"purl":"pkg:github/daviddesmet/paseto-dotnet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/daviddesmet%2Fpaseto-dotnet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/daviddesmet%2Fpaseto-dotnet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/daviddesmet%2Fpaseto-dotnet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/daviddesmet%2Fpaseto-dotnet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/daviddesmet","download_url":"https://codeload.github.com/daviddesmet/paseto-dotnet/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/daviddesmet%2Fpaseto-dotnet/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35104115,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-03T02:00:05.635Z","response_time":110,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dotnet","dotnet-core","netstandard","paseto"],"created_at":"2024-07-30T21:00:41.613Z","updated_at":"2026-07-03T23:01:10.299Z","avatar_url":"https://github.com/daviddesmet.png","language":"C#","funding_links":["https://github.com/sponsors/daviddesmet","https://paypal.me/daviddesmet"],"categories":["Cryptography"],"sub_categories":[],"readme":"# Paseto.NET, a [Paseto](https://github.com/paragonie/paseto) (Platform-Agnostic Security Tokens) implementation for .NET\r\n\r\n[![CI](https://github.com/daviddesmet/paseto-dotnet/actions/workflows/ci.yml/badge.svg)](https://github.com/daviddesmet/paseto-dotnet/actions/workflows/ci.yml)\r\n[![Maintenance](https://img.shields.io/maintenance/yes/2026.svg)](https://github.com/daviddesmet/paseto-dotnet)\r\n[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/daviddesmet/paseto-dotnet/issues)\r\n\r\n## Features\r\n\r\nPASETO protocols\r\n\r\n| purpose | v1 | v2 | v3 | v4 |\r\n| -- | -- | -- | -- | -- |\r\n| local | ✅ | ✅ | ✅ | ✅ |\r\n| public | ✅ | ✅ | ✅ | ✅ |\r\n\r\nPASERK extension\r\n\r\n| type | support |\r\n| -- | -- |\r\n| lid | ✅ |\r\n| local | ✅ |\r\n| seal | ❌ |\r\n| local-wrap | ❌ |\r\n| local-pw | ❌ |\r\n| sid | ✅ |\r\n| public | ✅ |\r\n| pid | ✅ |\r\n| secret | ✅ |\r\n| secret-wrap | ❌ |\r\n| secret-pw | ❌ |\r\n\r\n## Installation\r\n\r\n[![NuGet Version](https://img.shields.io/nuget/v/Paseto.Core)](https://www.nuget.org/packages/Paseto.Core/)\r\n\r\nInstall the Paseto.Core NuGet package from the .NET CLI using:\r\n```\r\ndotnet add package Paseto.Core\r\n```\r\n\r\nor from the NuGet package manager:\r\n```\r\nInstall-Package Paseto.Core\r\n```\r\n\r\n## Usage\r\n\r\n[![](https://img.shields.io/nuget/dt/Paseto.Core.svg)](https://www.nuget.org/packages/Paseto.Core/)\r\n\r\n### PASETO\r\n\r\nThe library exposes a Fluent API with several method overloads found in `Use()`, `WithKey()`, `AddClaim()`, `AddFooter()` and so on to provide the flexibility needed for encoding and decoding PASETO tokens and also for generating the required symmetric or asymmetric key pairs. However, you can use the Protocols and Handlers directly if you like.\r\n\r\n\u003e [!NOTE]\r\n\u003e Implicit assertions (`AddImplicitAssertion()`) are only supported by protocol versions **v3** and **v4**. For v1 and v2 tokens the assertion is ignored, as the PASETO spec provides no way to bind it — do not rely on it for those versions.\r\n\r\nBelow are a couple of examples for the most common use cases:\r\n\r\n#### Generating a crypto random Symmetric Key\r\n\r\n```csharp\r\nvar pasetoKey = new PasetoBuilder().Use(version, Purpose.Local)\r\n                                   .GenerateSymmetricKey();\r\n```\r\n\r\n#### Generating an Asymmetric Key Pair\r\n\r\n```csharp\r\nvar pasetoKey = new PasetoBuilder().Use(version, Purpose.Public)\r\n                                   .GenerateAsymmetricKeyPair(seed);\r\n```\r\n\r\n**NOTE:** A seed is not required for protocol v1.\r\n\r\n#### Generating a Token\r\n\r\n```csharp\r\nvar token = new PasetoBuilder().Use(version, purpose)\r\n                               .WithKey(key)\r\n                               .AddClaim(\"data\", \"this is a secret message\")\r\n                               .Issuer(\"https://github.com/daviddesmet/paseto-dotnet\")\r\n                               .Subject(Guid.NewGuid().ToString())\r\n                               .Audience(\"https://paseto.io\")\r\n                               .NotBefore(DateTime.UtcNow.AddMinutes(5))\r\n                               .IssuedAt(DateTime.UtcNow)\r\n                               .Expiration(DateTime.UtcNow.AddHours(1))\r\n                               .TokenIdentifier(\"123456ABCD\")\r\n                               .AddFooter(\"arbitrary-string-that-isn't-json\")\r\n                               .Encode();\r\n```\r\n\r\n#### Decoding a Token\r\n\r\n```csharp\r\nvar result = new PasetoBuilder().Use(version, purpose)\r\n                                .WithKey(key)\r\n                                .Decode(token);\r\n```\r\n\r\nOr validate the token's payload while decoding (the header and signature is always validated):\r\n\r\n```csharp\r\nvar valParams = new PasetoTokenValidationParameters\r\n{\r\n    ValidateLifetime = true,\r\n    ValidateAudience = true,\r\n    ValidateIssuer = true,\r\n    ValidAudience = \"https://paseto.io\",\r\n    ValidIssuer = \"https://github.com/daviddesmet/paseto-dotnet\"\r\n};\r\n\r\nvar result = new PasetoBuilder().Use(version, purpose)\r\n                                .WithKey(key)\r\n                                .Decode(token, valParams);\r\n```\r\n\r\n### PASERK\r\n\r\nThe library also provides the PASERK extension for encoding and decoding a key.\r\n\r\nA serialized key in PASERK has the format:\r\n\r\n```\r\nk[version].[type].[data]\r\n```\r\n\r\n#### Encoding a Key\r\n\r\n```csharp\r\nvar paserk = Paserk.Encode(pasetoKey, type);\r\n```\r\n\r\n#### Decoding a Key\r\n\r\n```csharp\r\nvar key = Paserk.Decode(paserk);\r\n```\r\n\r\n## Roadmap\r\n\r\n- [ ] Add support for remaining PASERK types and its [operations](https://github.com/paseto-standard/paserk/blob/master/operations).\r\n- [ ] Add support for version detection when decoding.\r\n- [ ] Add support for custom payload [validation rules](https://github.com/paseto-standard/paseto-spec/blob/master/docs/02-Implementation-Guide/02-Validators.md).\r\n- [ ] Improve documentation.\r\n\r\n## Test Coverage\r\n\r\n[![codecov](https://codecov.io/gh/daviddesmet/paseto-dotnet/branch/master/graph/badge.svg?token=O9QHck0xb9)](https://codecov.io/gh/daviddesmet/paseto-dotnet)\r\n\r\n- Includes the mandatory [test vectors](https://github.com/paseto-standard/test-vectors) for PASETO and PASERK.\r\n\r\n## Cryptography\r\n\r\n* Uses Ed25519 (EdDSA over Curve25519) algorithm from CodesInChaos [Chaos.NaCl](https://github.com/CodesInChaos/Chaos.NaCl) cryptography library.\r\n* Uses Blake2b cryptographic hash function from [Konscious.Security.Cryptography](https://github.com/kmaragon/Konscious.Security.Cryptography) repository.\r\n* Uses AES-256-CTR, ECDSA over P-384 algorithms from [Bouncy Castle](https://github.com/novotnyllc/bc-csharp) cryptography library.\r\n* Uses XChaCha20-Poly1305 AEAD from [NaCl.Core](https://github.com/daviddesmet/NaCl.Core) repository.\r\n\r\n## Dependency Lock Files\r\n\r\nThe repository uses [NuGet lock files](https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#locking-dependencies) (`packages.lock.json`, committed per project) to pin the full dependency graph, including transitive packages. CI restores with locked mode enabled, so a build fails if the resolved packages differ from the lock files — protecting against floating transitive versions and dependency-confusion attacks.\r\n\r\nUpgrading packages therefore changes slightly:\r\n\r\n- Edit the package version in the `.csproj` (or let Dependabot do it), then run `dotnet restore --force-evaluate` from the repository root and commit the updated `packages.lock.json` files together with the `.csproj` change.\r\n- Dependabot PRs update the lock files automatically.\r\n- A plain `dotnet restore` locally never floats versions; it follows the lock files. If it reports `NU1004`, the lock files are out of date — run `dotnet restore --force-evaluate`.\r\n\r\n## Learn More\r\n\r\n[![License](https://img.shields.io/github/license/daviddesmet/paseto-dotnet.svg)](https://github.com/daviddesmet/paseto-dotnet/blob/master/LICENSE)\r\n\r\n* [PASETO (Platform-Agnostic SEcurity TOkens)](https://github.com/paseto-standard/paseto-spec) is a specification and reference implementation for secure stateless tokens.\r\n* [PASERK (Platform-Agnostic SERialized Keys)](https://github.com/paseto-standard/paserk) is an extension to PASETO that provides key-wrapping and serialization.\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdaviddesmet%2Fpaseto-dotnet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdaviddesmet%2Fpaseto-dotnet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdaviddesmet%2Fpaseto-dotnet/lists"}