Why this matters
Tokens are the credentials of modern identity. When an API accepts a token without checking its signature, audience or expiry, whoever holds the token is whoever it claims to be.
The mistakes are usually small: a library switched from verify to decode during testing, a token that lives for a month, an audience check that was never added. This inspector shows them in seconds, without pasting a live token into someone else's website.