In more detail
The parts are header, payload and signature, joined by dots, each Base64URL-encoded (the URL-safe variant of Base64, without padding). The payload is only encoded, not encrypted, so anyone can read it; the signature stops it being altered. The payload holds claims: registered ones include iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before) and iat (issued at), all with times in Unix seconds. Servers verify the signature and the exp claim on each request. See How JSON Web Tokens (JWT) Work.
Why it matters
A JWT lets a server trust a request without looking up a session, which is convenient but has consequences. Never put secrets in the payload. Always verify the signature and check the expected algorithm yourself, because accepting alg: none or letting an attacker swap an RSA public key into an HMAC check are classic breaches. A JWT cannot be revoked before it expires unless the server keeps a deny list, so keep lifetimes short.
Example
This token is signed with HS256 and the secret secret:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFkYSIsImV4cCI6MTg5MzQ1NjAwMH0.lwtVWslOzi3-XOCNPaatMVvy-kA3ItEPISOUqJBK_ws
The header decodes to {"alg":"HS256","typ":"JWT"} and the payload to {"sub":"1234","name":"Ada","exp":1893456000}; exp is 2030-01-01 00:00:00 UTC. Paste it into the JWT Decoder to read it, or build one with the JWT Generator & Verifier.
Common confusion
Signed does not mean secret, and "decoded" does not mean "verified". For the signature scheme see HMAC; JWTs are often issued as access tokens in OAuth flows.