docs: public static JWT verify(String jwt, byte[] secret) {
      // 1. verify that the jwt contains at least one period ('.') character
      if (jwt.indexOf(".") <= 0)
        throw new DecodeException("Illegal jwt: no '.' character inner");
  
      // verify and verify header, payload
      String[] hps = jwt.split("\\.");
      Header header = Header.decode(hps[0]);
  
      // a unsecured JWT is not supported this time
      if (header.algorithm == Algorithm.NONE && hps.length == 2)
        throw new DecodeException("'none' algorithm is not support.");
  
      // secured jwt
      if (hps.length != 3)
        throw new DecodeException("Illegal jwt: not [header].[payload].[signature] format");
      Payload payload = Payload.decode(hps[1]);
  
      // verify the signature
      byte[] signature = SignerFactory.get(header.algorithm)
        .sign((hps[0] + "." + hps[1]).getBytes(StandardCharsets.UTF_8), secret);
      if (!hps[2].equals(new String(signature, StandardCharsets.UTF_8))) {
        throw new DecodeException("Illegal jwt: signature not match");
      } else {
        return new JWT(header, payload);
      }
    }