Decode a JWT's header and payload as formatted JSON
This only decodes the token — it does not verify the signature. A token that decodes cleanly here could still be invalid, forged, or expired.
Nothing you enter here leaves your browser.