The three parts of a JWT
A JWT looks like xxxxx.yyyyy.zzzzz. The first part (header) says which algorithm signed it, the second (payload) holds the claims — user ID, roles, expiry — and the third is the signature. The first two are Base64URL-encoded JSON, which is why anyone can read them.
Reading the standard claims
exp is the expiry time, iat is when it was issued, nbf is the time it becomes valid, sub is the subject (usually the user), iss is the issuer and aud is the intended audience. Times are Unix timestamps; the decoder shows them as readable dates.