1

JWT decoding is local — signature is not verified.