No logins. No tracking.
Decode JWT headers and payloads, inspect timing claims, and verify signatures locally