JWT Expiry Checker

Is this token still valid in time?

Even a correctly signed JWT becomes useless once its lifetime ends. The expiry checker reads the time-based claims from the payload and compares them to now, telling you whether the token is active and how long until it dies. It does not touch the signature; it only interprets the timestamps the token carries.

The claims that control timing

Three claims matter. exp is the expiration time, after which the token must be rejected. nbf (not-before) marks the earliest time the token is valid, so a token can be legitimately rejected for being too early. iat (issued-at) records when it was minted. All three are Unix timestamps in seconds, not milliseconds.

Example

iat = 1700000000  issued
nbf = 1700000000  valid from
exp = 1700003600  expires (1 hour later)

now = 1700002000  -> active, 26m40s remaining
now = 1700005000  -> expired 23m20s ago

To turn any of these raw numbers into a human date, the timestamp converter does the arithmetic for you.

Clock skew and short windows

Servers often allow a small leeway (a minute or two) when checking exp and nbf because client and server clocks drift. A token that looks barely expired to you may still be accepted within that grace window, and vice versa. Short-lived tokens paired with refresh tokens are the usual pattern for limiting exposure if one leaks.

FAQ

My token has no exp, when does it expire? Never, on its own. A token without exp relies entirely on server-side revocation, which is a risk worth flagging.

Why does the server reject a token that looks unexpired? The server may enforce a shorter effective lifetime, a different clock, or revocation that the raw timestamps cannot reveal.