Coze VS paseto

https://cyphr.me/coze#?input={%22pay%22:{%22msg%22:%22Hello,...

We're working on an open source alternative to Passkeys starting with Coze https://github.com/Cyphrme/Coze.

We have not yet published our next steps, but we will soon.

You can play with Coze here using the online tool. There is also the simple tool.

Base64 also has problems, in particular with canonicalization. This is a problem that I think needs more awareness in the industry. It does seem to recently gained some awareness (See the paper, "Base64 Malleability in Practice")

Coze is a cryptographic JSON messaging specification designed for human readability.

Our website is already using public key authentication using Coze. https://github.com/Cyphrme/Coze. We've been doing public key authentication for around 2 years now. No passwords needed, just public key auth.

On my website, I'm doing authentication via simple public key authentication using Coze.

No passwords. No email. No Google. https://github.com/Cyphrme/Coze

Might I suggest Paseto (https://paseto.io/) - it solves a lot of the headaches of JWT. Signing and encryption are two different things that require two different sets of keys, so you can't mess it up.

(Full disclosure, I've written one implementation: https://github.com/auth70/paseto-ts)

Though we'll be building a session-based authentication system, it's noteworthy that with the introduction of some concepts which will be discussed in due time, you can turn it into JWT- or, more securely and appropriately, PASETO-based authentication system.

Time we ditch it and use paseto

The PASETO web site goes over it. Mostly it's designed to make you do things the right way and avoid all the security holes you can fall into with JWT.

If this is too much to handle, you shouldn't have to! There's already solutions that handle it for you