JWT Expiration Checker
Paste a JWT to instantly check if it is expired. See the exp, iat, and nbf claims as human-readable dates with real-time expiry status — all without leaving your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How JWT token expiration works
JWT expiration is controlled by three registered claims: exp (expiration time), iat (issued at), and nbf (not before). The exp claim is a Unix timestamp (seconds since January 1, 1970 UTC) after which the token must not be accepted. A server verifying a JWT must reject it if the current time is past exp — typically with a small clock skew tolerance (often 30-60 seconds) to allow for minor differences between server clocks.
The iat claim records when the token was issued, enabling you to calculate the token's age. The nbf (not before) claim is the counterpart to exp — it specifies a time before which the token must not be accepted. For example, a token might be issued now but intentionally not be valid until 5 minutes in the future.
Paste your JWT above and switch to the Claims tab to see exp, iat, and nbf decoded as human-readable timestamps with live expiry status. The tool also shows how long ago the token was issued and exactly how much time remains until expiry.
JWT time claims
- exp
- Expiration Time — token must not be accepted after this Unix timestamp.
- iat
- Issued At — Unix timestamp when the token was created.
- nbf
- Not Before — token must not be accepted before this Unix timestamp.
- Clock skew
- Typical tolerance of 30-60 seconds to handle clock drift between servers.
- Token lifetime
- exp − iat = token validity window in seconds.
- Common lifetimes
- Access tokens: 5–60 min. ID tokens: 1 hr. Refresh tokens: 1–30 days.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.