JWT Expired? Expiration Checker

The JWT Expiration Checker tells you whether a JWT is expired at a given moment. It reads the exp claim, compares it with the current time or a time you choose, and shows how long ago the token expired or how long it has left. It runs in your browser, is free, and needs no sign-up or account.

Use it when an app says a token has expired, when you want to know how long a token lasts, or when you need to test a token at a specific future or past time. It reads the time values only. It does not check the signature, so it cannot tell you whether a token will be accepted by a server.

How to use the JWT Expiration Checker

1. Paste your JWT into the Token field.
2. Leave Check at (UTC, optional) empty to use this device’s clock now. To test another moment, enter an ISO 8601 time such as 2026-01-31T12:00:00Z, or a Unix time in seconds.
3. If you need to allow for a small difference between clocks, open More options and set Clock skew (seconds). The default is 0.
4. To try the tool with sample input, pick a preset: Expired token (the default), Valid token, No exp claim, or nbf in the future.
5. Read the Verdict. If exp is a usable number, the big figure Seconds until exp (negative = expired) appears too.
6. Check exp, expiration time, nbf, not before, iat, issued at, and Token lifetime (exp - iat). Only the claims present in your token are shown.
7. Read Rule used, How it was calculated, and any warnings. Confirm that Signature says it was not checked.

Nothing you paste is sent or stored, and the token is never placed in the page address or in a copied link. Each check runs on this page alone, so you can rerun it with a different Check at time without losing your input. Use Copy result, Copy link or Print / save as PDF to keep the result, and Reset to return to the sample.

jwt expired meaning

A JWT is expired when the check time is on or after its exp value. RFC 7519 section 4.1.4 says the token must not be accepted from that point on, so the expiry moment shown as exp, expiration time is the jwt expired at time.

jwt is expired meaning

To say a jwt is expired and is no longer valid means its exp time has passed by the clock doing the check. Expiry is only one of the things a server may check, so this result does not prove the token is accepted.

How do I check if a JWT is expired?

Read the exp claim, a number of seconds since 1970-01-01T00:00:00Z, and compare it with the current time. The token is expired when the check time is greater than or equal to exp plus the clock skew. The tool does this comparison and shows how long ago it happened.

What is exp in a JWT?

exp is the expiration time, a NumericDate in seconds (RFC 7519, section 2). The current time must be before exp, so the token must not be accepted on or after that moment.

Why does my JWT say expired right after I got it?

The most common causes are an exp written in milliseconds, a device clock that is wrong, a time zone mistake (exp is always based on UTC), or a very short lifetime. A warning appears when the value is above 1e11, which points to milliseconds. Compare the Token lifetime (exp - iat) line with what the issuer intended.

How long is my token valid?

Its lifetime is exp - iat, shown as Token lifetime (exp - iat) when both values are usable. The time left from the check time is shown as Seconds until exp (negative = expired). If iat is missing, only the time left is available.

What is nbf?

nbf is the “not before” time. RFC 7519 section 4.1.5 says the token must not be accepted before this time, so the current time must be on or after nbf.

Does this check the signature?

No. The Signature line reads “Not checked”, and the tool ignores the signature entirely. A decoded token is only readable text until its signature is verified, so use the JWT validator to check the signature.

Can I check at a future date?

Yes. Enter an ISO 8601 time in Check at (UTC, optional), or a Unix time in seconds. A time without a zone is read as UTC, and an offset such as +02:00 is applied. An impossible date such as 2026-02-30 is reported as an error.

What if there is no exp claim?

The token then carries no expiry time, and the verdict says “No exp claim: the token carries no expiry time”. RFC 7519 makes exp optional, so a token without it is not automatically expired.

Sources (checked 2026-10-15): RFC 7519.

Worked examples

Calculated by the tool above; open it with the same values to see each step.

Frequently asked questions

What does “tokenexpirederror jwt expired” mean?

Many apps show an error like this when the exp of the token is at or before the server’s time. Paste the same token here and check the verdict, and also check that the clocks of the issuer and the verifier agree.

Does a “Valid for” verdict mean my app will accept this token?

No. The verdict only covers the time claims. A server may also check the signature, the audience, the issuer, and other rules that this page does not read.

What does clock skew do?

Clock skew (seconds) adds a small allowance to exp and nbf, for differences between servers. The default is 0. RFC 7519 allows “some small leeway, usually no more than a few minutes”, and the tool shows a warning above 300 seconds.

Is my token stored or sent anywhere?

Nothing is sent or stored, and the page never contacts a server. Even so, any live production secret pasted into any website should be treated as exposed, so test values are the better choice.

Can I use this tool to check what time my token was issued?

Yes. The iat, issued at line shows the issue time in ISO UTC with a relative description, when iat is present. The line is omitted when the claim is missing.

Related tools

• JWT decoder - Read the header and payload of a token when you want to see every claim.
• JWT validator - Check the signature when you need to know whether a token was changed.
• JWT generator - Create test tokens with chosen exp and iat values.
• JWT secret generator - Make a random secret for signing test tokens.
• Token decoder - Inspect a token’s readable parts when it is not a JWT.
• Base64url encoder and decoder - Convert the Base64url segments of a token to and from plain text.
• HMAC SHA256 generator - Compute an HMAC SHA256 value when you are testing signatures by hand.