JWT Expiration Checker

Runs in browser Security

Reads exp, nbf and iat claims and reports the token's validity window in your local timezone and UTC, with a live countdown.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is a JWT?

A JSON Web Token is a compact string of three Base64url segments — header.payload.signature — that carries claims about a user or client (subject, roles, expiry) together with a signature the receiver can verify. Defined in RFC 7519 with its signing rules in RFC 7515 and 7518, it is the usual format for OAuth 2.0 access tokens and OpenID Connect ID tokens. The payload is only encoded, not encrypted: anyone holding the token can read it.

Security note: Decoding is not verifying. A server must check the signature with a pinned algorithm, reject alg=none, and validate exp, iss and aud — and a real token pasted anywhere is a secret until it expires.

Read the guide: What is a JWT? JSON Web Tokens Explained

How to use JWT Expiration Checker

  1. Paste the JWT.
  2. Read the status and the countdown to expiry (or how long ago it expired).
  3. Set a clock-skew tolerance if your servers accept a few seconds of leeway.
  4. Use the timestamps table to compare UTC and local times when debugging timezone issues.
Before nbf a token is not yet valid, from nbf until exp it is valid, and from exp on it is expired; a clock-skew tolerance widens both edges, but only in a separate row. Conceptual model

Token with nbf and exp

  • now < nbfNot yet validFail
  • nbf ≤ now < expValidPass
  • now ≥ expExpiredFail
  • nbf − skewskew
  • exp + skewskew
  1. 1iat issued atUsed for Lifetime and Elapsed, not for the status.
  2. 2nbf not beforeValid from this moment; without nbf there is no start limit.
  3. 3now Checked at: your device clock
  4. 4exp expirationAt exp itself the token is already expired.

Token with nbf but no exp

  • now < nbfNot yet validFail
  • now ≥ nbfNo expiry: a security riskCaution

Positions are illustrative. Status and the live countdown always use the exact edges; the tolerance only adds a separate With Ns skew row when it changes the verdict.

JWT Expiration Checker features

  • Instant verdict: valid, expired, not yet valid, or no expiry
  • Live countdown that updates every second in your browser
  • exp, nbf, iat and auth_time shown as Unix time, UTC, local time and relative time
  • Lifetime and percentage of lifetime already elapsed
  • Optional clock-skew tolerance to mirror server leeway
  • Detects millisecond timestamps and expired-before-issued mistakes

JWT Expiration Checker example

Check a token that expires in 2100

Input:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzhmM2EyYyIsImlhdCI6MTcwMDAwMDAwMCwibmJmIjoxNzAwMDAwMDAwLCJleHAiOjQxMDI0NDQ4MDB9.…

Output:

Status: Valid — expires in <time remaining when you check> (2100-01-01 00:00:00 UTC)
Issued: 2023-11-14 22:13:20 UTC
Lifetime: 76y 2mo

Frequently asked questions about JWT Expiration Checker

How is "expired" determined?

The exp claim (seconds since the Unix epoch) is compared with your computer's clock. A token is expired from the moment the clock reaches exp (exp is now or in the past), and "not yet valid" while nbf is still in the future. Add a clock-skew tolerance to mimic servers that allow a few seconds of leeway.

My server still rejects a token this tool says is valid — why?

Servers also check the signature, issuer and audience, and may enforce a shorter maximum age than exp. Clock differences between your machine and the server can matter too — compare the "Checked at" time with the server's clock.

What if the token has no exp claim?

The tool reports "No expiry". Such tokens never expire on their own, which is a security risk; the issuer should always set exp.

Does the countdown update automatically?

Yes. Once a token is checked, the remaining time is recalculated every second in your browser.

Technical notes

JWT timestamps are NumericDate values — seconds since 1970-01-01T00:00:00Z ignoring leap seconds. The checker compares them with your device clock, so a wrong local clock produces wrong verdicts; the "Checked at" row shows the reference time used.

References