Signed vs Unsigned JWT
Verified tokens versus alg=none structures—compare what a signature guarantees and why unsigned tokens are a teaching tool only.
Overview
A JWT is three Base64url segments, and only the third one—the signature—separates a credential from a wish. The alg=none variant exists in the specification, which is exactly why verifiers must pin expected algorithms rather than trusting the header. Building an unsigned token by hand makes that failure mode concrete instead of theoretical.
Signed JWT
Open JWT DecoderPros
- Signature proves the issuer produced it
- Standard for API and session tokens
- Claims can be trusted after verification
Cons
- Verification requires correct key management
- Accepting the header algorithm blindly is dangerous
Unsigned JWT
Open Unsigned JWT BuilderPros
- Shows the three-part token structure clearly
- Useful for demonstrating the alg=none flaw
- Handy for parser and fixture testing
Cons
- Anyone can rewrite the payload
- Never acceptable in production auth
Comparison table
| Aspect | Signed JWT | Unsigned JWT |
|---|---|---|
| Signature | Present and verifiable | Absent, alg is none |
| Trust after decode | Only after verification | Never |
| Correct use | Production auth | Education and test fixtures |
| Best fit | Any token that carries authority in a real system | You are learning token structure or testing a parser |
Recommendation
Always verify signatures with a server-side allowlist of algorithms and keys, and reject alg=none outright. Use unsigned tokens only to study structure or to test that your verifier rejects them.
Related tools
Related articles
Related comparisons
Frequently asked questions
- Does decoding a token prove anything?
- No. Decoding only reveals the header and payload. Without signature verification against a known key, every claim inside is attacker-controlled.
- How do I defend against algorithm confusion?
- Pin the expected algorithm in your verifier configuration, never derive it from the token header, and separate signing keys from public verification keys.
- What pushes someone toward Signed JWT instead of Unsigned JWT?
- Signed JWT wins when any token that carries authority in a real system. The practical upside is that signature proves the issuer produced it, and standard for API and session tokens. The trade-off to watch is that verification requires correct key management.
- When does Unsigned JWT beat Signed JWT for the same job?
- Reach for Unsigned JWT when you are learning token structure or testing a parser. It gives you shows the three-part token structure clearly plus useful for demonstrating the alg=none flaw, at the cost that anyone can rewrite the payload.
- Can ToolHub help me try Signed JWT and Unsigned JWT before I commit?
- Yes. The tools linked from each side of Signed vs Unsigned JWT run in your browser, so you can exercise Signed JWT and Unsigned JWT with sample data without uploading anything.