JWT Decoder & Expiration Calculator
Use this fast, client-side JWT decoder to decode JSON Web Tokens, inspect payload claims, and check remaining token lifespan instantly. Paste any Bearer token below to convert raw Unix timestamps into human-readable local dates without sending credentials over the network.
What is a JWT Decoder?
A JWT decoder is a developer utility that parses encoded JSON Web Tokens into readable JSON objects. It splits the compact token into its three distinct Base64Url components: the Header (algorithm details like HMAC or RS256), the Payload (session claims like user IDs and permissions), and the Signature.
When working with authentication providers like Auth0, Okta, Firebase, or custom OAuth 2.0 Authorization servers, tokens arrive in the HTTP Authorization: Bearer <token> header. A decoder lets you inspect the raw payload directly in your browser to debug identity state without backend logs.
How to Check if a JWT Token is Expired
To determine whether a token has expired, inspect the exp claim inside the decoded payload. The exp claim stores a Unix epoch timestamp (seconds elapsed since January 1, 1970 UTC).
Compare that value against the current epoch time. If current time exceeds the exp integer, the token is expired and APIs will reject the request with an HTTP 401 Unauthorized status.
Step-by-Step Epoch Conversion Example
- Token exp claim:
1787961600(Unix seconds) - Current epoch time:
1787958000(Unix seconds) - Difference (TTL):
1787961600 - 1787958000 = 3,600 seconds(1 hour remaining) - JavaScript Date conversion:
new Date(1787961600 * 1000)yields the exact calendar date.
JWT Expiration Time Checker Formula
Remaining Lifespan (seconds) = exp - Math.floor(Date.now() / 1000)A result greater than 0 means the token is active. A result equal to or less than 0 means the token is expired and requires refresh-token rotation or re-authentication.
Token Validation vs. Token Verification
Developers often mix up token validation and token verification:
- Token Validation (Payload Inspection): Checking whether claims are logically valid—confirming that the token is not expired (
exp), is active (nbf), and originates from the expected issuer (iss). - Token Verification (Cryptographic Check): Using a secret HMAC key or an asymmetric public key (RS256 via JWKS) to verify that the token's signature matches its payload and has not been tampered with in transit.
An online JWT exp claim converter to date handles validation checks in the browser, while your backend API gateway handles cryptographic verification.
Standard Registered Claims Breakdown
| Claim | Name | Description |
|---|---|---|
| exp | Expiration Time | Unix epoch timestamp when token validity terminates. |
| iat | Issued At | Unix epoch timestamp recording when the auth server created the token. |
| nbf | Not Before | Timestamp identifying the earliest moment the token can be processed. |
| iss | Issuer | The identity provider or auth server domain that minted the token. |
| sub | Subject | The unique identifier (user ID or client ID) of the principal. |
| aud | Audience | The target recipient or resource server URI intended for this token. |
Frequently Asked Questions
What does the "exp" claim mean in a JWT?
The exp (expiration time) claim identifies the exact moment a JSON Web Token stops being valid. It is formatted as a NumericDate Unix timestamp in seconds since January 1, 1970 (UTC). Applications must reject tokens when the current time equals or exceeds this timestamp.
How do I know when my JWT token expires?
To know when your JWT expires, decode the payload using a JWT decoder, locate the exp claim, and multiply that Unix timestamp value by 1000 to convert seconds to milliseconds. Then parse it with a standard date utility to see your local expiration date and remaining lifespan.
Can you decode a JWT without a secret key?
Yes. The Header and Payload of a JWT are only Base64Url-encoded, not encrypted. Anyone can decode and view claims without a secret key. The secret key or public certificate (such as HMAC secrets or RS256 keys) is only needed to verify the cryptographic signature.
Is it safe to decode a JWT in the browser?
Yes, provided the tool runs purely on the client side. This tool processes your token entirely in your local browser runtime. No Bearer tokens, sensitive user claims, or headers are ever transmitted across the network or stored on remote servers.
Why is my JWT token invalid or expired?
A JWT typically fails validation due to reaching its exp lifespan, clock drift between the authentication provider and API server, generating timestamps in milliseconds instead of seconds, or reading an unactivated token before its nbf (not before) claim timestamp.
JWT Expiration & Payload Decoder
Token Expiration Status
Valid* All JWT decoding and time calculations occur entirely in your local browser. Sensitive tokens and secret keys are never transmitted to any external server.
Check out 4 similar collection of developer calculators