Paste a token to see its header and payload decoded, with the time claims rendered as dates and the expiry checked against now. Decoding happens in your browser and nothing is sent anywhere — which matters, because a JWT is a credential and pasting one into a remote service hands over whatever it authorises.
No, and this surprises people. The header and payload are Base64url-encoded, not encrypted — anyone holding the token can read every claim in it. The signature proves the token has not been altered; it does not hide anything. Never put a secret in a JWT payload.
Verifying needs the signing secret or public key, and pasting either into a web page is exactly the habit that leads to leaked credentials. This tool tells you what a token claims and is explicit that it has not checked whether those claims are genuine.
A token can declare that it is unsigned. Libraries that honour that declaration will accept a token whose signature has simply been deleted, letting anyone forge any claim. It has caused real breaches. The decoder flags it when it appears.