JWT Expiry Checker

Instantly see if a JWT is expired — with exact expiry time in your timezone, UTC, and remaining lifetime.

Tokens are decoded locally in your browser and never leave your device. The signature is not verified.

Expiry report

Paste a JWT to see whether it is expired, and exactly when it expires in your timezone and UTC.

Decoding happens locally. The signature is not verified and the token is never sent anywhere.

About this tool

"Is this token still valid?" shouldn't require a Node REPL. Paste a JWT and this checker decodes it locally, reads the exp, iat and nbf claims, and tells you plainly whether it's expired — plus exactly when it expires in your local time and UTC, and the token's total lifetime.

Bearer prefixes are stripped automatically, so you can paste straight from an Authorization header.

How to use it

  1. Copy a JWT (with or without the Bearer prefix).
  2. Paste it — the verdict appears instantly.
  3. Check the exp/iat/nbf rows for precise timestamps.
  4. Remember: signature is NOT verified — this is a decoder, not a validator.

Useful ways to apply it

  • Debugging 401 errors — is the token expired or is something else wrong?
  • Checking how long your auth provider's tokens actually live.
  • Verifying that a refresh flow issued a token with a future exp.
  • Confirming an nbf (not-before) claim isn't rejecting early use.

Frequently asked questions

Is the token sent to a server?
Never. Decoding is pure base64url math done by JavaScript in your browser. Still, avoid pasting production tokens anywhere unnecessarily.
Why does it say the signature is not verified?
Verification requires the signing secret or public key. This tool only decodes claims — treat the output as informational, never as proof of authenticity.
What if there's no exp claim?
The checker flags it: a token without exp never expires, which is usually a security smell.

Privacy

Tokens are decoded locally in your browser and never leave your device. The signature is not verified.