A JWT is three base64url segments: a header naming the signing algorithm, a payload of claims, and a signature. The first two are not encrypted — anybody holding the token can read them — so decoding one needs no key and no server. This does it in the page, works out whether the token is still valid from its exp claim, and renders the timestamps as dates.
The decoding happens in your browser and the token never crosses the network. That matters more here than it sounds: a JWT is a live credential, and pasting a production token into a tool that posts it to a server is a credential disclosure. Load this page, disconnect, and it still works.
It does not verify the signature, and no decoder that only has the token can. Verification needs the signing key, which is exactly the thing you are not going to paste into a web page. Read the output as "this is what the token claims", not as "this token is genuine" — anybody can craft a JWT that decodes cleanly and is signed with nothing.
exp is expiry and iat is issue time, both as seconds since the epoch rather than milliseconds, which is the off-by-1000 that breaks most first attempts. sub is the subject, aud the intended audience and iss the issuer; a token valid for a different audience is a real and easily-missed cause of a 401. Scopes and roles are conventions rather than standards, so they appear under whatever name the issuer chose.