crypto
JWT
Decode header and payload locally, and say loudly when the token has expired.
This decodes; it does not verify. A JWT's payload is base64, not encryption: anyone holding the token can read it. Nothing here checks the signature, so never trust a decoded payload as proof of anything. And do not paste a live production token into any web tool, including this one.
Signature (not checked)