Skip to content
English
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

JWT Expiration Checker

See at a glance whether a token’s time claims put it inside or outside its validity window, and by how much.

Processed locally in your browser

Options

ISO date or Unix seconds, for testing. Empty = your device clock.

The token is decoded locally and never sent anywhere. Decoding does not verify the signature.0 chars · 0 lines
The result will appear here.

What is JWT Expiration Checker?

JWT time claims are Unix timestamps in seconds: exp is the moment the token stops being acceptable, nbf the moment it starts, and iat when it was issued. This tool compares them with the current time and reports the remaining time or the time since expiry, the lifetime between iat and exp, and whether nbf has been reached.

Two options make it useful for debugging. Clock skew adds leeway in seconds (a token counts as expired only after exp plus the skew, and as not yet valid only until nbf minus the skew), the way many libraries do. “Pretend now is” lets you test any moment in ISO format or Unix seconds.

How does it work?

  1. Paste the token; “Bearer ” prefixes and whitespace are fine.
  2. Optionally set a clock-skew tolerance in seconds to mirror your verifier’s leeway.
  3. Optionally enter a date such as 2025-01-31T12:00:00Z in “Pretend now is” to test a specific moment.
  4. Read the status, the remaining time or time since expiry, and the iat, nbf and exp rows.

Common use cases

  • Finding out whether a 401 came from an expired token or from something else.
  • Verifying a token’s lifetime matches the configured access-token duration.
  • Testing how a token behaves five minutes before and after it expires.
  • Diagnosing clock drift between an issuer and a verifier using the skew option.

Examples

Try this input in the tool above:

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMzQiLCJuYW1lIjoiRGVtbyBVc2VyIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUudGVzdCIsImF1ZCI6ImRlbW8tYXBwIiwiaWF0IjoxNzAwMDAwMDAwLCJuYmYiOjE3MDAwMDAwMDAsImV4cCI6MTkwMDAwMDAwMCwianRpIjoiZGVtby0wMDAxIn0.ZHVtbXktc2lnbmF0dXJlLW5vdC1hLXJlYWwtaG1hYw
Output
"Now" used: 2026-09-25T01:21:41.347Z (your device clock)
Clock skew tolerance: 0 s
Expires (exp): 2030-03-17T17:46:40Z · local: Mar 17, 2030, 6:46:40 PM · expires in 1269 d 16 h 24 min
Issued at (iat): 2023-11-14T22:13:20Z · local: Nov 14, 2023, 11:13:20 PM · issued 1045 d 3 h 8 min ago
Not before (nbf): 2023-11-14T22:13:20Z · local: Nov 14, 2023, 11:13:20 PM · started 1045 d 3 h 8 min ago
Lifetime (iat → exp): 2314 d 19 h 33 min
Time remaining: 1269 d 16 h 24 min
nbf state: reached

Privacy

JWT Expiration Checker runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

This tool only evaluates time claims. It does not verify the signature, so a token can look unexpired here and still be forged or revoked. Your own device clock is used unless you provide a “now”.

Frequently asked questions

Does “not expired” mean the token is valid?

No. It only means the time claims are inside their window. Validity also requires a correct signature, issuer, audience and that the token has not been revoked, none of which this tool checks.

What is clock skew tolerance?

Servers’ clocks rarely agree perfectly. A tolerance of, say, 60 seconds means exp is enforced 60 seconds late and nbf 60 seconds early, avoiding false rejections. The default here is 0.

What if the token has no exp claim?

Then it never expires by its own claims. The tool warns you, because tokens without an expiry stay usable forever if they leak.

Related tools

More tools in Developer Tools →