Good to know : You can only paste parts of the token and it will decode it without any problem. I always leave the signature part out of it when I use this tool.
If you have concerns that the page might steal the tokens, leaving out the signature if you're not trying to debug it prevents a valid token from touching the site.