Does this tool verify the JWT signature?

No. Verifying a signature requires the server's private key or secret key, which should never be shared with client-side applications. We only decode the headers and payload parameters.

How is token expiry (exp) checked?

The decoder extracts the numeric 'exp' epoch timestamp from the payload, converting it to local time and checking it against the current browser clock.