$ ./jwt-decoder

// decodes header + payload only. no signature verification, no network calls, nothing leaves your browser.