No. This tool only Base64URL-decodes the header and payload. A readable token is not a trusted token. Signature verification is a separate step and is not included here.
When present as numeric Unix timestamps, the tool shows absolute UTC time and a relative phrase such as “expires in 12m” or “expired 3h ago”. Color alone is not the only signal.
No. Decoding runs entirely in your browser. Tokens are not sent to a server, logged, or persisted.
A JWT must be header.payload.signature with dots separating exactly three Base64URL segments. Missing dots, extra segments, or pasted Bearer prefixes can trigger this error.
Yes. Expiry only affects whether the token should be trusted at runtime — decoding still shows header and payload so you can inspect claims and exp timestamps.