Paste a JWT to decode its header and payload. This does not verify the signature — it only decodes the base64url-encoded parts, so never trust a token's contents without verifying it against your issuer's key. Everything runs locally in your browser; nothing is sent anywhere.