Decoding only — the signature is NOT verified. Never trust a token's claims without verifying it on the server. The token never leaves your browser.