This decodes the token locally in your browser only — nothing is sent anywhere. It does not verify the signature, since that needs the secret/private key.