Paste a JSON Web Token to read its header, payload and every claim in plain words, with the expiry worked out against the clock on your device. Check the signature too: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA with a PEM public key or a JWK.
A token is a live credential, which is the whole reason this runs in your browser. Nothing is uploaded, nothing is logged, and nothing survives closing the tab.