Decode and inspect JWT header and payload (no signature verification).
The token is split and decoded locally. The signature is not verified, so this does not prove the token is authentic.
JWT inspection happens entirely in your browser. Tokens are never sent to a server. Never paste production secrets into any online tool unless you trust it.