JWT is decoded client-side. Your token never leaves the browser.