none
What this is
The JWS spec allows alg none for 'unsecured' JWTs: two segments, empty signature. Early libraries honored the header, skipped crypto, and accepted forged admin tokens. Modern verifiers must deny none unless explicitly opted in for tests. Never in production. Tests only, and even then prefer a real key.
Open the decoder and paste a none token. Verification stays in the browser.
FAQ
- What does this tool do with none?
- It still decodes the payload so you can inspect it, and it prints a hard warning. Verification reports unsigned.