Every JWT library does the same handful of steps under the hood: decode, reconstruct the signing input, verify. Most developers never see this part, jwt. verify() hides it completely, and that's usually fine.
Source: [Dev.to](https://dev.to/auth_parse_/how-to-verify-a-jwt-signature-without-a-library-1a1a)