Three parts
A JSON Web Token is three pieces of base64url separated by dots: a header, a payload and a signature. Paste one, with or without Bearer in front, and the header and payload are shown as formatted JSON, with the algorithm, key ID, issuer, subject and audience listed above them.
Dates and expiry
The iat (issued), nbf (not before) and exp (expires) claims are seconds since 1970, so they are shown as dates in UTC and as a time from now. The line under the box says whether the token has expired, is not valid yet, or has no expiry, and warns when it is not signed at all (alg: none).
Decoded, not verified
The signature is not checked. That needs the secret or the issuer's public key, and is the server's job: anyone can write a token with any payload, so what this shows says nothing about whether the token is genuine.
Questions
Can this verify a JWT's signature?
No, by design. Verifying needs the secret or the issuer's public key, and a page you paste secrets into is the wrong place for them. Use your server's JWT library, which also checks the algorithm, issuer and audience.
Is it safe to paste a real token?
Nothing you paste leaves the page. A live token is still a key, though: anyone who sees it can use it until it expires, so do not paste one where others can see your screen.
Why does it say my token has five parts?
That is an encrypted token (JWE) rather than a signed one. Its payload is encrypted and cannot be read without the key.