Decoding a JWT does not verify its signature. Never treat decoded claims as trusted unless the token has been cryptographically verified by a trusted backend or verification process.