Dev tools · alternatives · 2026
24 alternatives to PAST, a secure alternative to JWT
Platform-Agnostic Security Tokens. Contribute to paragonie/paseto development by creating an account on GitHub.
PAST is a security-focused authentication token format designed as an alternative to JWT. It addresses common security vulnerabilities found in JSON Web Tokens by providing a more robust approach to token generation… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. PAST, a secure alternative to JWT launched in 2018; newer entries below may have overtaken it.
- 1
Frictionless security: auth & user management with passkeys
2023 · 1password.com · its alternatives →
- 2
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
2023 · github.com · its alternatives →
- 3
A Virtual FIDO2 USB Device. Contribute to bulwarkid/virtual-fido development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 4BO
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
2023 · its alternatives →
- 5JI
The team at Rownd is excited to announce https://jwt.is, an updated take on JSON Web Token debugging. Like most developers, we've used jwt.io for years, but it lacks a number of useful features that would make it even more convenient. We're building on the shoulders of those who've come before us. :-) In addition to the basic JWT decoding and signature verification, we've added things like: - Verification using JWK endpoints - Locally stored history of tokens and keys - Verification for EdDSA signatures - Detection of common token providers (e.g., Google, Apple, etc) - Dark mode!…
2023 · its alternatives →
- 6
This is a project I made to learn more about crypto. I've also written a [post](https://vaktibabat.github.io/posts/ecurvechat/) that explains all the crypto concepts and algorithms used in the project, and how I implemented them. I'd be very glad for any feedback about both the code and the post :)
2024 · github.com · its alternatives →
- 7CM
2018 · cipherbrowser.com · its alternatives →
- 8
This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers. Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking. It's deliberately minimal — no OAuth, no passkeys, no magic links, no rate limiting — because the goal is clarity and auditability. I wrote it mainly to deeply understand edge-runtime auth constraints and to have a clean Apache-2.0 example that…
Feb 2026 · github.com · its alternatives →
- 9
- 10ET
- 11
Demonstration of the WebAuthn specification.
2023 · webauthn.io · its alternatives →
- 12
An admin-friendly, User Management Server (with Passkeys & JWTs) - for seamless and secure integration of user authentication - authcompanion/authcompanion2
2023 · github.com · its alternatives →
- 13
- 14
- 15LE
Hi guys, I've written the first proof-of-mistake crypto token on top of Ethereum. You can see it at http://www.lostethereum.com/ It's basically a proof-of-burn substitute for users who mistakenly sent to the wrong address. It requires a web3 enabled browser, i.e chome with MetaMask, Parity, Mist, etc. This let's the web interface seamlessly interact with the Ethereum network. Let me know what you guys think.
2017 · its alternatives →
- 16
Token-efficiency linter for LLM prompts and payloads - ritenv/tokensift
Aug 2026 · github.com · its alternatives →
- 17SI
Identify and remediate code security and privacy risks in your DevSecOps workflows.
2018 · bearer.sh · its alternatives →
- 18DB
Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login security and asked us to add a session hijacking prevention feature to our fraud prevention API. In the end, we decided to just implement a solution in Javascript. We call it session-lock, and it can be used today across all browsers[2] and, theoretically, native mobile apps. For a…
2024 · session-lock.keyri.com · its alternatives →
- 19WT
2016 · android.fallible.co · its alternatives →
- 20
An OSS KMP crypto + PKI library with a comprehensive ASN.1 engine. Android and iOS targets come with hardware-backed crypto + key storage, and native biometric auth.
2025 · github.com · its alternatives →
- 21ST
Angular module: https://github.com/lynndylanhurley/ng-token-auth Rails gem: https://github.com/lynndylanhurley/devise_token_auth I've been working hard to make this the most simple, flexible, and secure token auth system in existence. I believe that I'm close to succeeding. I'd love to hear your thoughts on what I can do to improve what I have so far.
2014 · its alternatives →
- 22
Hello. I made this project as an experiment in using key cryptography for user identity in a client server model, and for some future peer to peer projects that I am working on. I am looking for feedback, please let me know what you think. Also, Merry Christmas to HN! :-)
2022 · github.com · its alternatives →
- 23IB
I built Oxidiko because I was tired of seeing companies lose millions of passwords to sloppy authentication systems that were never designed for privacy or modern threats. I’m Jonathan, a 17-year-old developer and security enthusiast, and I wanted to create a simpler, more secure, and privacy-first way to log in. Oxidiko reduces the attack surface by eliminating central password storage, encrypting all vault data locally, and making the user’s identity portable — so even if your server is breached, there’s nothing meaningful to steal. It uses WebAuthn (passkeys) combined with a PIN fallback…
2025 · its alternatives →
- 24
Hello there, I’m Guillaume, the cofounder and CEO of Bearer, a code security startup trying to rethink security products for a developer-first World. 7 months ago we introduced on HN, Bearer CLI (https://github.com/Bearer/bearer), our free and open code security scanner supporting at the time only Ruby and JavaScript applications. We’ve been working very hard with the team, thanks to community feedback to bring tons of new features as well as more language support to become everyone’s go-to code security solution. Just to name a few major features: - Native integration…
2023 · github.com · its alternatives →
Also compare
- Passage by 1Password alternatives
- Open-source Auth0 alternative Ory Kratos v0.13 released – nearing v1.0 alternatives
- A virtual Yubikey device for 2FA/WebAuthN alternatives
- Bearer – Open-source code security scanning solution (SAST) alternatives
- Jwt.is – JSON Web Token Debugger alternatives
- An Elliptic Curve-Based Secure Chat, Written Using Rust and Protobuf alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →