Decode a JSON Web Token to see its header and payload, and whether it has expired. The signature is not verified. Avoid pasting live production tokens into any online tool.