Decodes JWT header and payload only. Signature verification requires your keys and a server-side library.