JWT Missing alg Header – Why the Decoder Shows Algorithm Unknown

Local only

Inspect a valid JSON JWT header that omits alg and see how the decoder exposes the missing algorithm metadata.

50 chars · 1 line

75 chars · 8 lines

Algorithm: UnknownSignature not verifiedTime status: Not evaluated (no numeric exp/nbf)

JWT header troubleshooting

Why a JWT can decode with no alg header

The JWT header can be valid JSON even when it does not contain an alg member. This decoder therefore shows the header object but reports Algorithm: Unknown and keeps the token unverified rather than turning missing metadata into a JSON parsing error. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Decode the header and check whether an alg member exists.
  2. If the issuer is expected to produce a signed JWT, inspect its token-generation configuration.
  3. Do not infer or guess an algorithm client-side; let a trusted verifier enforce the expected policy.

Missing alg is different from invalid header JSON

The header is still a JSON object, so decoding succeeds. Algorithm: Unknown is a display status showing that the expected string metadata was not available.

Header without alg

The typ member decodes normally, but no algorithm string is available.

Decoded header

{"typ":"JWT"}

Decoder detail

Algorithm: Unknown

Common questions

Frequently asked questions

Why is this not an Invalid JWT header error?

Because the segment still decodes to a valid JSON object. The missing alg field is a semantic header issue, not malformed JSON.

Will the decoder guess HS256 or another algorithm?

No. Guessing would hide token-generation problems and is not a safe verification strategy.

Can I trust the remaining claims?

No. They remain unverified until a trusted verifier validates the token.

Recommended next steps

JWT alg noneInspect a token whose header declares the none algorithm without treating it as trusted.JWT Invalid JSON HeaderFix a Base64URL header whose decoded text is not a JSON object.JWT Signature Not VerifiedUnderstand why decoding JWT claims does not authenticate the token.

Debugging a specific JWT issue? Browse JWT troubleshooting.