pyseto

What it is and what it does

PySETO is a complete Python implementation of the PASETO and PASERK standards, which define secure token formats for authentication and key serialization. It supports all four PASETO protocol versions (v1, v2, v3, v4) and both use cases: v*.public for asymmetric public-key signatures and v*.local for symmetric authenticated encryption. The package also implements PASERK, a standard for serializing and wrapping cryptographic keys, including password-based key encryption and key wrapping.

The library is built on top of cryptography, argon2-cffi, iso8601, and pycryptodomex, delegating the actual cryptographic operations to these battle-tested dependencies. It provides a simple API: create a Key object with a version and purpose, then call encode() to sign or encrypt a payload and decode() to verify and decrypt. The package has passed all official PASETO test vectors and supports both raw bytes and JSON serialization of payloads and footers.

Use it for:

• Generate and verify stateless authentication tokens for REST APIs or microservices using v4.public asymmetric signing.
• Encrypt and authenticate session data or sensitive payloads using v4.local symmetric encryption without a database.
• Serialize and store cryptographic keys securely using PASERK with password-based or key-wrapping protection.
• Build multi-version token support for gradual protocol migration (e.g., from v2 to v4) across distributed systems.
• Implement registered claims (exp, iat) and custom footers (e.g., key IDs) in tokens for standards-compliant authentication.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

PySETO implements PASETO (Platform-Agnostic SEcurity TOkens) and PASERK (Platform-Agnostic Serialized Keys) standards in Python, supporting all protocol versions (v1–v4) for both public-key signing and symmetric authenticated encryption.

Yes. PySETO is actively maintained, has no known vulnerabilities, uses permissive MIT licensing, and provides a complete, spec-compliant implementation of PASETO/PASERK with low install friction. Install it if you need stateless token authentication or secure key serialization and prefer a standards-based alternative to JWT or custom token schemes.

Install

pyseto on PyPI

pip install pyseto

uv add pyseto

poetry add pyseto

Installing pyseto

Before you install

Low install friction with a pure-wheel distribution. The package is actively maintained with a recent release (26 days old) and an active repository. Dependencies on cryptography, argon2-cffi, iso8601, and pycryptodomex are all standard, well-maintained cryptographic libraries.

License in practice

MIT license permits commercial and private use with minimal restrictions; you may use, modify, and distribute this package freely as long as you include the license notice.

Quickstart

pip install pyseto

import pyseto
from pyseto import Key

private_key = Key.new(version=4, purpose="public", key=private_key_pem)
token = pyseto.encode(private_key, b'{"data": "message"}')

public_key = Key.new(version=4, purpose="public", key=public_key_pem)
decoded = pyseto.decode(public_key, token)

Requires Python 3.10 or later; PEM-formatted keys must be provided as bytes.

Verify before relying

• Whether the package has undergone independent security audit or formal verification of PASETO spec compliance beyond the official test vectors.
• Performance characteristics (token generation/verification latency) under typical workloads.

Package facts

Evidence: pyseto-1.10.0-py3-none-any.whl

Tags

More Cryptography packages