Decode any JSON Web Token. Inspect header, payload, expiry, and algorithm. Verify HMAC signatures client-side. Your token never leaves the browser.