What a JWT actually contains
A JSON Web Token is three Base64url segments joined by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Only the signature involves a key. The header and payload are plain encoded JSON that anyone can read.
This is the single most misunderstood thing about JWTs. Putting a user's email, role or internal ID in a token is fine — putting anything you would not print on a postcard is not. The signature guarantees integrity, not confidentiality.
Debugging with a decoder
Most JWT problems are one of three things: the token has expired, the claims are not what the issuer thinks they are, or the algorithm in the header does not match what the verifier expects. All three are visible without a key, which is what makes decoding a useful first step. The expiry check here compares exp against your device clock — if that clock is wrong, so is the verdict.
The segments are Base64url-encoded, so the Base64 decoder will read them individually. To convert the epoch timestamps by hand, use the Unix timestamp converter. To inspect the Authorization header a token arrived in, use the HTTP header parser.