JWT Verifier

Verification recomputes the signature over the token's header and payload using the key you provide, then checks whether that result matches the signature segment already in the token. A match proves two things simultaneously: the token was signed by whoever holds that key (or the matching private key, for asymmetric algorithms), and the header and payload haven't been altered since — changing even one character of either would produce a completely different expected signature.

This is the fundamental difference between decoding and verifying: decoding reads what a token claims; verifying proves those claims came from a party who actually holds the signing credential. A token can decode perfectly and still fail verification, which is exactly what happens if someone edits a payload claim (changing a role from "user" to "admin", for instance) without also being able to re-sign it — the signature simply won't match anymore.