You need the payload, not the signing key
Three parts: header, payload, signature. For “is it expired?” and “is aud right?”, decoding the first two pieces is enough. Verification needs a secret. That secret does not belong in a browser tool.
Copy the token from the response or Authorization, strip the Bearer prefix, paste into JWT Decoder.
Watch exp (and nbf)
exp is usually Unix seconds. Drop it into Timestamp Converter in seconds mode and see if it’s already past. Skewed device clocks create fake “I just got this token” bugs.
Also check nbf, iss, aud. Mismatched claims often mean the wrong environment, not a missing header in the client.
With JSON and pipelines
Format the whole API body first, then copy the token out. Faster than selecting inside a minified string.
Fine for staging. Don’t paste long-lived refresh tokens, private keys, or client secrets into a web page. The decoder shows claims; it doesn’t babysit your vault.