What to look at
- exp / nbf / iat: times in seconds since 1970. A wrong server clock makes valid tokens “expired”.
- iss and aud must match exactly what the application expects — case and trailing slash included.
- alg: none must never be accepted.
- Decoding is not verifying: only someone with the issuer's key can check the signature.
Privacy
Runs entirely in your browser; nothing is sent or stored.