Decode a JWT header and payload, check expiry, and verify HS256 signatures.
Verify signature
The secret is only used in your browser.
Waiting for input