Checks that a token has the correct three-part structure (header.payload.signature) with valid Base64URL-encoded, parseable JSON in each part, and reports whether it's currently expired based on its exp claim.
This does not verify the cryptographic signature. Confirming a signature is genuine requires the issuer's secret or public key, which this tool never asks for — pasting that key into a web tool would defeat the point of keeping it secret. For structural and expiration checks, this is accurate; for "is this token authentic," you need your backend's own verification.