Decodes header & payload locally. Signature is NOT verified — never paste production secrets anywhere.