Decode a JSON Web Token's header and payload. Runs entirely in your browser — your token is never sent anywhere.