Decode a JSON Web Token to inspect its header and claims. Signature is not verified — everything runs in your browser.