Is the signature verified?
No. The tool only decodes the token; verifying the signature needs the secret key and belongs on your server.
Is it safe to paste a real token?
The token never leaves your browser. Still, avoiding production tokens on shared computers is a good habit.