JWT decoder splits a JSON Web Token into its three parts and base64url-decodes them locally. The signature is not verified — never trust a JWT without checking the signature against your secret or public key.