Decode JWT header and payload locally. Signature, issuer, audience and expiry are NOT verified.
JavaScript is required. File-service operations request explicit consent before upload.