JWT Expiry Checker — Live Token Expiration Countdown
Decode · Inspect · Verify · Generate JSON Web Tokens — expiry countdown, security warnings, HS256 verify — 100% browser-side
Token expiry is the most common cause of authentication failures in production. This JWT expiry checker instantly shows whether your token is valid, expired, or about to expire — with a live countdown timer for tokens expiring within 5 minutes. All expiry times are displayed in both UTC and IST, making it easy to correlate with server logs.
What is a JWT Decoder?
A JWT Decoder reads a JSON Web Token and displays its three parts in human-readable format. Every JWT contains a Header (algorithm & type), a Payload (claims — user data, expiry, issuer), and a Signature. This tool decodes all three instantly, shows expiry status with a live countdown timer, highlights standard claims with labels, detects security issues like alg:none, and supports HS256/HS384/HS512 signature verification using the browser Web Crypto API.
JWT Structure — How It Works
A JWT looks like xxxxx.yyyyy.zzzzz — three Base64URL-encoded strings joined by dots. The header and payload are readable by anyone; the signature is what proves authenticity. Only the party holding the secret or public key can verify the signature. This means JWTs should never contain sensitive data like passwords.
Frequently Asked Questions
How does JWT expiry work?
The exp claim is a Unix timestamp. When a server receives a JWT, it checks if the current time (in seconds) is greater than exp. If yes, the token is rejected with a 401 Unauthorized. The issuer sets exp when creating the token — typically 15 minutes to 24 hours for access tokens.
What happens when a JWT expires?
The server rejects it with 401 Unauthorized. The client must get a new token — either by using a refresh token (OAuth 2.0 pattern), re-authenticating the user, or silently refreshing if within the allowed window. Never extend an expired token client-side — always get a fresh one from the server.
How long should a JWT access token be valid?
Best practice: 15 minutes for sensitive APIs (banking, admin), 1 hour for standard web apps, up to 24 hours for mobile apps with refresh token rotation. Short-lived tokens minimize the damage if a token is stolen. Use refresh tokens for seamless UX without forcing re-login.
What is clock skew and how does it affect JWT expiry?
Clock skew is when the issuer server and verifier server have slightly different clocks. A token expired 30 seconds ago on the issuer might still appear valid on a verifier with a 1-minute clock skew. JWT libraries handle this with a "leeway" parameter — typically 30-60 seconds — to tolerate small clock differences.
Can I extend a JWT expiry without re-issuing?
No — JWT claims are part of the signature. Modifying exp invalidates the signature. To extend expiry, you must issue a new JWT. This is why refresh tokens exist — they are long-lived tokens (7-30 days) used only to get new short-lived access tokens without requiring the user to log in again.