A JWT has three Base64url-encoded parts separated by dots: header (algorithm), payload (claims such as sub, exp, aud) and signature. The content is encoded, not encrypted; anyone can read it. The signature only guarantees it has not been changed.
The receiver checks the signature with the issuer's public key (in OIDC from the JWKS endpoint), plus the expiry exp, issuer iss and audience aud.
Typical mistakes: long-lived tokens that cannot be revoked, sensitive data in the payload, and libraries that accept the none algorithm. When tokens are rejected, check the server clock.
Example
cut -d. -f2 token.txt | base64 -d 2>/dev/null