In a JWS, alg selects how the signature is computed: HS256, RS256, PS256, ES256, ES256K, Ed25519 and so on, or none. In a JWE it selects how the content key is delivered, while enc names the content cipher. Values are case-sensitive strings in the IANA "JSON Web Signature and Encryption Algorithms" registry.
The header is attacker-controlled until the signature is verified, so the verifier must not let it decide the algorithm: configure the accepted algorithm (ideally one) per key and reject everything else (RFC 8725 §3.1). Libraries that dispatch on alg have accepted none or used an RSA public key as an HMAC secret.
RFC 9864 (2025) deprecates "polymorphic" identifiers such as EdDSA, whose meaning depends on the key, in favor of fully specified ones such as Ed25519, so that the algorithm name alone determines the operation.