JWT Decoder reads a JSON Web Token's header and payload (the parts that are just base64url-encoded JSON, not encrypted) and shows them formatted, along with whether the token has expired.
No, and that's an important distinction. A JWT's header and payload are just base64url-encoded JSON, readable by anyone without any key. Verifying the signature (proving the token is authentic and unmodified) requires the issuer's secret or public key, which this tool doesn't ask for or need.
The token is decoded entirely in your browser and never sent anywhere, which is the main reason to use a local tool like this rather than an unknown web-based decoder. That said, treat any real access token as sensitive and avoid pasting it into tools you don't trust, this one included, unless you've confirmed it stays local.
They're standard JWT time claims: exp is when the token expires, iat is when it was issued, and nbf is "not before", the earliest time it's valid. All three are Unix timestamps (seconds since 1970), which this tool converts to a readable date.