Decode a JSON Web Token's header and payload, and check its expiration. Everything runs in your browser — the token is never sent anywhere.