paseto.js | PASETO : Platform-Agnostic Security Tokens | Authentication library

1 - Can "token" generated be altered like "JWT" and pass modified or tampered data?

Note that token cannot be "altered" either using PASETO or JWT without knowing the signing key (which should of course be secret).

The fact you mention about being able to view the JWT token data in JWT.io page is because data is not encrypted (so you can see it without the key).

But token is signed, so if you modify any value and don't have the key, you won't be able to sign it back and the token receiver will note the token is not valid when trying to verify it.

2 - Can "token" generated using "paseto" be decrypted and viewed like "JWT"?

It depends on how you generate the PASETO token.

See here:

https://tools.ietf.org/id/draft-paragon-paseto-rfc-00.html#rfc.section.2

Format for the token is version.purpose.payload.

And from the docs:

The payload is a string that contains the token's data. In a local token, this data is encrypted with a symmetric cipher. In a public token, this data is unencrypted.

So if you generate the token as in the code snippet you posted (local token, with a symmetric key), then payload will be encrypted (you won't be able to see it unless you know the symmetric key and use that one to decrypt it).

If you use a public/private key pair, then payload will not be encrypted, so you'll be able to see it without the key (but you'll not be able to change it and sign it again without knowing the private key).