JWT Decoder

No. It only decodes the readable header and payload parts. Signature verification needs the secret or public key on your own server, which a browser tool should never ask for.

The tool reads the exp (expiry) claim, converts it to a date, and compares it with the current time. If that date is in the past, the token is expired and your app would normally reject it.

Decoding happens fully in your browser and nothing is uploaded. Still, tokens can contain personal data, so avoid pasting production tokens into any third party tool.