jwt

decode a JWT's header and claims, with timestamps made readable (does not verify the signature)

Decoding is not verifying: anyone can mint a token that decodes to anything. Treat the claims as untrusted until the signature is checked against the issuer's key. alg: none is flagged because accepting it is a classic bypass.

Runs entirely in your browser; nothing is sent anywhere. Input is deliberately not saved in the URL.