JWT Expiration Calculator
JWT Expiration Calculator
Paste a JWT (JSON Web Token) to decode its payload and see its issued-at (iat) and expiration (exp) claims, converted to readable UTC times, plus how many seconds remain before it expires.
This decodes the token's payload only — it does not verify the cryptographic signature, so it tells you what the token claims about itself, not whether it's authentic or was issued by a trusted source. That distinction matters for how you use it: it's a genuinely useful debugging tool for checking why an API call is being rejected as "expired" or confirming a token's lifetime during development, but it should never be treated as an authentication check on its own. Everything runs locally in your browser, so it's safe to paste real tokens while debugging without sending them to any server.
- Decoding only, no verification: this reads the token's payload claims but does not verify its signature — it tells you what the token claims, not whether it's authentic.
- Runs entirely in your browser: your token is decoded locally using JavaScript and is never sent to a server, so it's safe to paste real tokens for debugging.
- Standard claims used:
iat(issued at) andexp(expiration), both Unix timestamps in seconds, as defined by the JWT (RFC 7519) specification.
Why does it say "Invalid JWT format"?
A JWT must have three dot-separated parts (header.payload.signature) — check that you copied the entire token including all periods.
Why does it say "No expiration claim found"?
Not all JWTs include an exp claim — some tokens (like certain refresh tokens) are designed to never expire on their own and rely on server-side revocation instead.
JWT Expiration Calculator
Paste a JWT (JSON Web Token) to decode its payload and see its issued-at (iat) and expiration (exp) claims, converted to readable UTC times, plus how many seconds remain before it expires.
This decodes the token's payload only — it does not verify the cryptographic signature, so it tells you what the token claims about itself, not whether it's authentic or was issued by a trusted source. That distinction matters for how you use it: it's a genuinely useful debugging tool for checking why an API call is being rejected as "expired" or confirming a token's lifetime during development, but it should never be treated as an authentication check on its own. Everything runs locally in your browser, so it's safe to paste real tokens while debugging without sending them to any server.
- Decoding only, no verification: this reads the token's payload claims but does not verify its signature — it tells you what the token claims, not whether it's authentic.
- Runs entirely in your browser: your token is decoded locally using JavaScript and is never sent to a server, so it's safe to paste real tokens for debugging.
- Standard claims used:
iat(issued at) andexp(expiration), both Unix timestamps in seconds, as defined by the JWT (RFC 7519) specification.
Why does it say "Invalid JWT format"?
A JWT must have three dot-separated parts (header.payload.signature) — check that you copied the entire token including all periods.
Why does it say "No expiration claim found"?
Not all JWTs include an exp claim — some tokens (like certain refresh tokens) are designed to never expire on their own and rely on server-side revocation instead.