How do I check if a JWT is expired?

Paste the token. The tool reads the exp claim, a number of seconds since 1970-01-01T00:00:00Z, and compares it with your device’s clock. At or after exp the status is Expired and Expires in reads expired 0s ago, then counts up: expired 2h 3m 0s ago. Before exp it reads Not expired with the time left.

Does this verify the JWT signature?

No. Checking a signature needs the issuer’s secret (HMAC) or public key (RSA, ECDSA), and this tool does not do it. Anyone can write a token with any exp, so Not expired means only that the token claims it has not expired. A server must verify the signature before it trusts a claim.

Can anyone read what is inside a JWT?

Yes, for a signed token. RFC 7519 makes the claims the payload of a signed token, which is encoded but not encrypted. Only an encrypted JWT hides them; it has five parts instead of three, and this tool says it cannot read it.

Why does it say the value looks like milliseconds?

RFC 7519 defines exp, nbf and iat as seconds since 1970. A value above 100,000,000,000 is almost surely milliseconds. For exp 1700003600000 the tool shows the problem and the date it would be as milliseconds, 2023-11-14T23:13:20Z, and does not use the value.

What does Not yet valid (nbf) mean?

The nbf claim, not before, is still in the future. RFC 7519 says the token must not be accepted before that time. With nbf 1700003600 and exp 1700007200, read at 1700000000, the status is Not yet valid (nbf) and Expires in shows 2h 0m 0s.

Is the token sent anywhere?

The page decodes the token in your browser; the tool does not send it anywhere or save it, and it is never read from the address bar. A copy saved by an older version of the tool is deleted when the page loads.

JWT Expiration Checker

Decode a JWT and compare its exp, nbf and iat claims with your clock to see Expired or Not expired and the time left. The signature is not verified. How it works

JWT token

Decoded in your browser; the tool does not send the token anywhere or save it.

Token status

Paste a token to check it

Expires in —

About the JWT Expiration Checker

A token with exp 1700003600 (2023-11-14T23:13:20Z) is Not expired at 1699996220 with 2h 3m 0s left, and Expired from 1700003600 on. The JWT expiration checker decodes the token and compares its exp, nbf and iat claims with your device’s clock. It does not verify the signature, so it shows what the token says about itself, not that it is genuine.

Status of one token at four clock readings

Clock reading (UTC)	Status	Expires in
2023-11-14T21:56:40Z	Not expired	1h 16m 40s
2023-11-14T23:12:35Z	Not expired	45s
2023-11-14T23:13:20Z	Expired	expired 0s ago
2023-11-15T01:16:20Z	Expired	expired 2h 3m 0s ago

Token with header {"alg":"HS256","typ":"JWT"} and payload {"sub":"user-42","iat":1700000000,"exp":1700003600}. Computed with the tool’s own check; the page reads your clock itself and refreshes every second. No clock leeway is applied.

How to use this tool

Paste the token, or the whole Authorization header value: a leading Bearer is removed. Load sample fills in a token that expires in the year 2124.
Read the status: Expired, Not expired, Not yet valid (nbf), No expiration claim or Expiration claim not readable.
Read Expires in, and the local time of exp, nbf and iat. The UTC and Unix seconds are shown for exp.
Check the cautions above the claims: they say that nothing is verified, and flag an unsigned token or alg none.

Frequently asked questions

How do I check if a JWT is expired?: Paste the token. The tool reads the exp claim, a number of seconds since 1970-01-01T00:00:00Z, and compares it with your device’s clock. At or after exp the status is Expired and Expires in reads expired 0s ago, then counts up: expired 2h 3m 0s ago. Before exp it reads Not expired with the time left.
Does this verify the JWT signature?: No. Checking a signature needs the issuer’s secret (HMAC) or public key (RSA, ECDSA), and this tool does not do it. Anyone can write a token with any exp, so Not expired means only that the token claims it has not expired. A server must verify the signature before it trusts a claim.
Can anyone read what is inside a JWT?: Yes, for a signed token. RFC 7519 makes the claims the payload of a signed token, which is encoded but not encrypted. Only an encrypted JWT hides them; it has five parts instead of three, and this tool says it cannot read it.
Why does it say the value looks like milliseconds?: RFC 7519 defines exp, nbf and iat as seconds since 1970. A value above 100,000,000,000 is almost surely milliseconds. For exp 1700003600000 the tool shows the problem and the date it would be as milliseconds, 2023-11-14T23:13:20Z, and does not use the value.
What does Not yet valid (nbf) mean?: The nbf claim, not before, is still in the future. RFC 7519 says the token must not be accepted before that time. With nbf 1700003600 and exp 1700007200, read at 1700000000, the status is Not yet valid (nbf) and Expires in shows 2h 0m 0s.
Is the token sent anywhere?: The page decodes the token in your browser; the tool does not send it anywhere or save it, and it is never read from the address bar. A copy saved by an older version of the tool is deleted when the page loads.

Checking a token that fails with 401

Developers use it when an API call returns 401 and they suspect the access token is out of date: paste the token, or the whole Authorization header value, since a leading Bearer is removed, and read the status, the time left, the local times of exp, nbf and iat, and the UTC and Unix seconds of exp. It also helps with clock skew between a server and a device, and with a token whose exp is in milliseconds by mistake.

It decodes only. The signature is not checked, so the page shows what the token says about itself, not that it is genuine. A five-part encrypted token (JWE) is recognized but cannot be read.

How the status is worked out

A JWT is three Base64URL parts, header.payload.signature. The header and payload are JSON objects; exp, nbf and iat are numbers of seconds since 1970-01-01T00:00:00Z (RFC 7519 calls this a NumericDate). A value above 100,000,000,000 is read as milliseconds by mistake and not used.

exp at or before now: Expired, and RFC 7519 says the token must not be accepted on or after it
nbf in the future: Not yet valid (nbf), also when there is no exp; an exp already past still gives Expired
exp in the future: Not expired (a decoded token cannot be called valid)
no exp and no future nbf: No expiration claim
iat later than your clock: a clock-skew note, and the status is unchanged

The countdown reads 2h 3m 0s; after expiry it reads expired 2h 3m 0s ago. Example: a token with exp 1700003600 (2023-11-14T23:13:20Z) read at 1699996220 shows Not expired, 2h 3m 0s; at 1700003600 it shows Expired, expired 0s ago. The tool allows no clock leeway, while RFC 7519 lets servers allow a few minutes. Tokens up to 100,000 characters are read.

Fun Fact: A JWT payload is not encrypted. RFC 7519 treats a signed token's claims as the payload of a JSON Web Signature, so anyone holding the token can read them; a key is needed to check the signature, and only an encrypted token (JWE) hides the claims.

Related Tools

View all tools

Web

JWT Decoder

Paste a JSON Web Token to read its header, its payload and the exp, nbf and iat times in UTC. The signature is shown but not checked: nothing is verified.

Dev

URL Encoder/Decoder

Percent-encode or decode text as you type: one value with encodeURIComponent or a whole URL with encodeURI, and an option to read + as a space.

Conversion

Hex to ASCII

Convert hex to ASCII text: 48 65 6C 6C 6F is Hello. Bytes are read as UTF-8, and odd digit counts or bad characters get an error.

Text

ROT13 Cipher

ROT13 encoder and decoder, plus any Caesar shift from 1 to 25: each letter A to Z moves that many places. Digits, punctuation and accents stay as typed.

Dev

Base64 File to String

Encode a file of up to 5 MB to Base64 or a data URI, or decode Base64 back to a downloadable file named from its data URI type or first bytes.

Dev

HTML Entity Encoder

Encode text to HTML entities (& < > " ') or decode any of the 2,231 named references in the HTML standard and numeric ones such as é.