Split a compact JWT, base64url-decode the header and payload, and surface exp/nbf as local times. This is an inspector, not a verifier — it will not check signatures, which is the safe default in a static site.