Paste a JWT token to decode its header and payload. No secret required — this only decodes, it doesn't verify.