sicher

Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key.