This decodes only — it does NOT verify the signature. A decoded token's claims should never be trusted as authentic without server-side signature verification. Runs entirely in your browser.