Paste a JWT token to decode and inspect its header and payload. Runs entirely in your browser — tokens never sent anywhere.