How it works
The token is split on the dots into three parts. The header and payload are base64URL-decoded and JSON-parsed. The signature is shown as the raw third segment. Standard claim names (iss, sub, aud, etc.) are labelled, and timestamps (exp, nbf, iat) are expanded to UTC date-times.
FAQ
Why do you not verify the signature? Verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). Sending the secret to a static site is the opposite of safe. For verification, use your server or a CLI tool where you already have the key.
How is "expired" determined? If the payload contains an exp claim (a Unix timestamp in seconds), we compare it to the current time. If exp is in the past, the token is marked EXPIRED. Tokens without exp cannot be evaluated this way.
Is my JWT sent anywhere? No. The token is parsed entirely in your browser via base64URL decoding and JSON.parse.