Decode JWTs locally, inspect claims, and optionally verify HMAC signatures in the browser.