Read the header, payload and expiry of a token. Nothing is sent anywhere.
HMAC-SHA256 only, computed with WebCrypto in this tab. RS256 and ES256 need the public key infrastructure a browser tool should not pretend to have.