Decode a JSON Web Token’s header and payload locally.
Not a decodable JWT — it should look like header.payload.signature.
Decoding is not verification: anyone can read a JWT, only its signature proves it wasn’t tampered with. Signature verification requires the secret or public key and is deliberately not attempted here — never paste production tokens from a live site into any web tool.