JWT is widely deployed in a huge number of places and is a bit of a favourite in the banking industry at the moment. It's going to take a lot to displace it. It

JWT is widely deployed in a huge number of places and is a bit of a favourite in the banking industry at the moment. It's going to take a lot to displace it. It's also not solely used for session management (I've never used it for that). Paseto looks fine, it avoids some of the pitfalls of weak algorithms etc, but that's not exactly tough to mitigate. They even say in the page that keeping a whitelist of algorithms is the approach most people take to JWT anyway. Could JWT be made stronger and more foolproof? No doubt, but I'm not sure that at this point the world is ready to move on, in fact we seem to be going gangbusters deploying and developing around it. If PASETO is the future, perhaps the PASETO guys could talk to the OpenID folks and see if they can get some traction. But this is going to need to be led by the standards bodies and not by individual developers.