I know a lot of people just use the jwt.io website for decoding JWT tokens, but to me that always feels unsecure. It's definitely safer to use a command line tool on your own computer for that. I use the following jq command for that.
jq -R 'split(".") | .[1] | @base64d | fromjson' <<< ".... paste token here...."