Developer
Encoders, converters & dev utilities
Is My JWT Expired? — Check exp / nbf In-Browser
A JWT carries its own validity window in three NumericDate claims: iat (issued-at), nbf (not-before) and exp (expiry). These are epoch seconds — NOT milliseconds — so a value like 1516242622 is 2018-01-18 02:30:22 UTC. A token is expired when now ≥ exp, and not-yet-valid when now < nbf. This tool decodes your token and renders a live status badge — valid, expired, or not-yet-valid — computed client-side from your browser clock, showing the exp/nbf/iat times in both your local time and UTC so there is no ambiguity. A common bug is treating exp as milliseconds (multiplying or dividing by 1000 incorrectly); the NumericDate spec is seconds. Paste your token for an instant expiry verdict. Free, no login, nothing leaves the browser.
iat / nbf / exp are NumericDate = epoch SECONDS (not milliseconds) — RFC 7519
- Expired when now ≥ exp; not-yet-valid when now < nbf; otherwise within the validity window
- Worked example — exp 1516242622 = 2018-01-18 02:30:22 UTC (a token past this now shows Expired)
- Worked example — iat 1516239022 = 2018-01-18 01:30:22 UTC, one hour before that exp
- Live badge computed client-side from your browser clock — valid / expired / not-yet-valid
- Times shown in both local and UTC to avoid timezone confusion
- Common bug: exp is seconds — do not confuse it with JavaScript Date.now() milliseconds
Frequently asked questions
How do I know if a JWT is expired?
Look at the exp claim in the payload. It is a NumericDate — the number of seconds since the Unix epoch (1970-01-01 UTC). The token is expired when the current time is greater than or equal to exp. For example, exp 1516242622 is 2018-01-18 02:30:22 UTC, so any check run after that instant reports Expired. This tool decodes the token and shows a live valid/expired badge computed from your browser clock, along with the human-readable exp time in both local and UTC.
What is the difference between exp, nbf and iat?
All three are NumericDate (epoch seconds) claims. iat (issued-at) records when the token was created. nbf (not-before) is the earliest time the token may be accepted — before it, the token is "not yet valid". exp (expiration) is the time at or after which the token must be rejected. A token is currently usable only when nbf ≤ now < exp. This tool evaluates all three and tells you whether the token is valid now, still pending (now < nbf), or expired (now ≥ exp).
Why is exp a big number like 1516242622 instead of a date?
The JWT spec (RFC 7519) defines time claims as NumericDate: the number of seconds since 1970-01-01 UTC. It is a compact, timezone-free integer that any system can compare. The value 1516242622 corresponds to 2018-01-18 02:30:22 UTC. A frequent mistake is treating it as milliseconds (JavaScript's Date.now() returns milliseconds), which makes the date wrong by a factor of 1000 — remember JWT exp/nbf/iat are seconds. This tool converts it correctly for you.