Safer than most: it's decoded in this tab and the page's security policy blocks any outside connection. Still, treat live tokens like passwords and revoke any you've shared.

Not yet. Those need the issuer's public key; HMAC tokens (HS256 and friends) can be checked with your secret now.