Paste a JSON Web Token and read its header, payload and expiry. Decoding only, in your browser, with no secret asked for and nothing sent anywhere.
No, and that is deliberate. Verifying means handing a tool your signing secret, which is the one thing you should never paste into a web page. This decodes the two readable parts and shows the signature untouched.
A JWT is not encrypted. Header and payload are base64url of plain JSON, so anyone holding the token can read them. The signature only proves the token was not altered, which is why a JWT should never carry a secret in its claims.
They are Unix timestamps in seconds: issued at, not valid before, and expires. This tool prints each one in UTC and works out how long is left, or how long ago it lapsed, once the page has loaded.
In an httpOnly cookie if you can, because script cannot read it and an XSS then cannot walk off with the session. localStorage is readable by any script on the page, which includes anything an injected tag pulls in. If you use a cookie, set SameSite and mind CSRF.
You cannot, which is the trade the format makes: a signed token is valid until it expires, wherever it is. The workaround everyone lands on is a short expiry with a refresh token, plus a deny list for the rare token that must die now.