A compact JWT is three pieces of text separated by dots: a header, a payload, and a signature. The header and payload are Base64URL-encoded JSON. Anyone can decode them. The signature is what lets a verifier decide whether those bytes were produced by someone who holds the key.
What the decoder shows
The JWT Decoder prints the header, the payload, and the raw signature segment. It sets signature_verified to false on every result. That is not a failure of the tool. The page does not have the signing key, and it should not pretend that it checked one.
If the algorithm is none, or the signature segment is missing, the status line says the token is not authenticated. Do not send that token to an API and expect the API to trust it.
Claims are data, not a verdict
exp, iss, and aud are useful to read. Seeing an expiration time does not mean the token is current, because the signature was not checked and the clock on this page is not an authorization decision. Use a verifier in the system that holds the key when you need a yes or no.
Do not paste a production access token into a shared computer. The decoder runs locally, but the device you are using can still remember what you typed.