What you can verify quickly
Whether `exp` is in the past (it’s usually seconds, not ms).
Whether `iat`/`nbf` make sense (clock skew can cause instant failures).
Whether custom claims (role/scope/user_id) are present and correct.
Important limits
Decoding ≠ trusting. JWT payload can be forged. Verify the signature server-side with the correct key/alg.
For `xxx.yyy.zzz`, decode segments as Base64URL.