alg:none (Unsecured JWT)

alg none is a JOSE algorithm identifier meaning the token has no cryptographic signature protecting integrity. Historically some libraries accepted tokens advertising alg none with an empty signature segment, which let attackers forge arbitrary payloads that applications treated as authenticated. Modern guidance is unambiguous: verifiers must not accept alg none for authentication or session establishment. Always pass an explicit allowlist such as HS256 or RS256 to your verify API so unexpected algorithms — including none — are rejected before claims are trusted. Security labs and the JWT Fuzzer use alg none variants to confirm APIs fail closed under hostile headers. Treating an unsecured JWT as authenticated is equivalent to trusting raw client-supplied JSON blindly.

Why It Matters

Algorithm confusion and alg none bugs have caused real-world authentication bypasses in production APIs worldwide. Defense is simple and non-negotiable: pin allowed algorithms, never derive trust from the unverified alg header alone, and test negative cases in CI. Platform libraries should default to deny-unknown-algorithm behavior so product teams cannot accidentally leave none enabled in production configuration files or legacy middleware stacks. Add automated tests that present forged alg none tokens to every verify path, including gateways and shared middleware. Document the allowlist in your platform README so product services cannot re-enable none through copy-paste configuration.

Code Example

Node.js

jwt.verify(token, secret, { algorithms: ['HS256'] }); // rejects alg:none

Related Comparisons

HS256 vs RS256

Related Tools

Jwt Fuzzer

Jwt Validator

Jwt Decoder

Debug Jwt Invalid Signature Common Jwt Vulnerabilities How To Validate Jwt Token

Frequently Asked Questions

Is alg none ever legitimate?

Only for non-security demos of unsigned JOSE objects. Never for login, API auth, or anything that grants access to data or actions.

How do I block alg none?

Pass an explicit algorithms allowlist to your verify API and reject any header alg outside that list with no fallbacks. Add negative tests that present alg none and empty signatures in CI.

Does decode protect me from alg none?

No. Decode only parses Base64URL segments. Treat decode output as untrusted display data until verify succeeds with pinned algorithms and validated claims.