JWT: decode and sign

Decode the header and payload of a token, or sign it with HMAC for testing. Everything in your browser, the token never leaves your device.