code: public function unmaskToken($maskedToken)
      {
          $decoded = StringHelper::base64UrlDecode($maskedToken);
          $length = StringHelper::byteLength($decoded) / 2;
          // Check if the masked token has an even length.
          if (!is_int($length)) {
              return '';
          }
  
          return StringHelper::byteSubstr($decoded, $length, $length) ^ StringHelper::byteSubstr($decoded, 0, $length);
      }
docs: Unmasks a token previously masked by `maskToken`.
  @param string $maskedToken A masked token.
  @return string An unmasked token, or an empty string in case of token format is invalid.
  @since 2.0.12