Decode a JSON Web Token WITHOUT verifying its signature and return the header, payload and signature. A structurally malformed token is rejected before payment. Never trust a decoded payload you have not verified.

Mint a signed JSON Web Token from a JSON claims object, using a shared secret (HS*) or a PEM private key (RS/ES/PS). Supports expiresInSec, notBeforeSec, issuer, audience, subject and keyid. An unusable key or option is rejected before payment.

Verify a JSON Web Token's signature and claims against a shared secret (HS*) or a PEM public key (RS/ES/PS). Returns { valid, payload } on success or { valid: false, reason } for a bad signature, expired/not-yet-active token, or a failed issuer/audience/subject check. Pass `algorithms` to pin the accepted signing algorithms and prevent algorithm-confusion attacks.