No — decoding the header and payload just requires base64 decoding, which doesn't need the secret. The secret is only needed if you want to verify the signature.
No — everything, including optional signature verification, runs locally in your browser via the Web Crypto API.
The tool will show an error indicating the token couldn't be parsed — double check that you've pasted the complete three-part token (header.payload.signature).