How to Decode a JWT Safely (and Why Decoding Isn't Verifying)

Most developers meet JSON Web Tokens while debugging: a login works locally but not in staging, an API returns 401, or a mobile client says a session expired too early. The first move is nearly always