把 JWT 拆成三段，读出声明并校验签名。
Paste the whole string, even with a leading "Bearer".
Only HS-family signatures (HS256, HS384, HS512) can be checked.
A JWT payload is Base64-encoded, not encrypted, anyone holding the token can read it. Never paste a live production token into any tool.
Paste a token, then press Decode.
