Can you decode JWT without secret?

Yes, the user can decrypt it and see the data , but if they modify it, when it gets back to the server it will not match and therefore be invalid.