A JSON Web Token (JWT) is a compact, signed token that a server issues to prove who a user is. It carries claims, like a user id, and a cryptographic signature. The server can trust the claims because it can verify the signature. The most common and dangerous mistake is reading a JWT's contents without verifying that signature.
How it works
A JWT has three parts: a header, a payload of claims, and a signature. The payload is only base64-encoded, not encrypted, so anyone can read it. The signature is what makes it trustworthy, because only the server with the secret can produce a valid one.
Decode vs verify
Decoding a JWT just reads the payload and checks nothing. Verifying checks the signature against your secret. If your code decodes without verifying, an attacker can hand you a token with any claims they like, for example an admin flag, and you will believe it. Always verify.
What this means for AI-generated code
AI tools sometimes use a decode function instead of a verify function, because the two have nearly identical names and both return the payload. The code works for legitimate tokens, so the missing signature check is invisible until someone forges a token.