public static function decode(string $data, string $secret )
  {
    # Make a HASH of the secret
    $secret = openssl_digest($secret,'sha256');

    $b64 = static::base64url_decode($data);
    $ewt = json_decode($b64,true);

    $payload = openssl_decrypt($ewt['p'], $ewt['a'], $secret, 0, $ewt['i']);

    # Verify signature - if fail return null
    if ( strcasecmp(static::sign($payload,$secret,$ewt['h']),$ewt['s'])!=0) {
      return null;
    }

    return $payload;
  }