Open /dev/jwt and paste the token. The page splits typ/alg and payload fields such as sub and exp.
exp is a Unix timestamp. Compare it with now to see expiry. Expired is not the same as a bad signature, and a valid-looking payload is not a reason to trust it.
Never treat a decoded payload as a login. Without the key you cannot verify HS256/RS256, and anyone can mint an unsigned payload.
To mint a test token use /dev/jwt-generate with a throwaway secret. Never reuse a production secret in the browser.