> JWT_DECODER

Decodes a JSON Web Token's header and payload. Does not verify the signature - that needs the secret key, which should never be pasted into a browser tab. Flags exp/iat/nbf claims as human-readable dates, and calls out an expired token.