Decode a JWT's header and payload — no signature verification, nothing leaves your browser.
This tool does not verify the signature — no secret or public key is used.