Use a header with alg set to none, a small demonstration payload and an empty signature after the final dot. JWTLens can display this three-segment form, but reports the signature as empty and the entire result as not verified.
Structure does not grant permission
A parser may recognize an unsecured serialization, but an application must reject it unless its deliberately specified protocol allows that exact case. Seeing alg none is information about bytes, never evidence that accepting them is safe.
Verification checklist
After inspecting structure, verify the compact token with a maintained JOSE library in the service that receives it. Pin the allowed algorithm; select the trusted key by reviewed policy; validate the signature before trusting claims; then enforce issuer, audience, subject, expiry, not-before, clock tolerance and application-specific requirements. Reject unexpected critical headers and duplicate data before authorization. JWTLens deliberately performs none of these trust decisions.