67 chars · 1 line
94 chars · 9 lines
Algorithm: noneSignature not verifiedTime status: Not evaluated (no numeric exp/nbf)
67 chars · 1 line
94 chars · 9 lines
JWT algorithm safety
The header value alg:none is readable metadata supplied by the token itself. This decoder displays Algorithm: none but still reports Signature not verified; it never treats the header's algorithm declaration as proof that an unsigned token should be trusted. This tool is free to use. No account or payment is required.
Last updated
A decoder can report what the header says. A verifier must independently enforce the algorithms and keys your application trusts instead of accepting a token-controlled choice by default.
The decoder reports the declared algorithm while preserving the verification warning.
{"alg":"none","typ":"JWT"}Algorithm: none
Signature not verifiedCommon questions
No. It does not verify any JWT signature and always keeps decoded claims untrusted.
No. Algorithm acceptance should come from trusted server configuration, not from an unverified token header.
Yes. Readability does not imply authenticity.
Debugging a specific JWT issue? Browse JWT troubleshooting.