Does this verify the signature?

No. Verification needs the secret or public key and must happen on your server. Decoding only reads what is in the token.

Is it safe to paste a token here?

The token never leaves your browser. Even so, a valid token is a credential, so prefer expired or test tokens when debugging.

The token is unsigned and can be forged by anyone. A correctly configured server rejects it.

JavaScript is turned off. InspireTools processes files in your browser, so the tools need JavaScript to run.

Decode a JSON Web Token to inspect its header, payload and expiry.