A Firebase ID token's aud claim is always your Firebase project ID, and iss takes the form https://securetoken.google.com/<project-id> — if either doesn't match your project, the token wasn't issued for your app. sub and user_id are both set to the Firebase UID (always identical to each other).
The nested firebase object carries sign_in_provider (e.g. google.com, password, anonymous) and an identities map of linked provider accounts — useful for telling which sign-in method was actually used for a given session.