Paste a JWT to inspect its header, payload, and claims. This only decodes — it never verifies the signature.