JWT Decode

Parse header & payload (no verify)