JWT Decoder & Expiration Checker
Decode a compact JWT header and payload, then check exp, nbf, iat, claim types, and time ordering against your device clock.
How to use
- Paste a compact JWT, with or without the Bearer prefix, into the input field.
- Optionally set a small clock tolerance, then decode the token and check its expiration.
- Review the decoded header and payload, copy either section or export both as JSON, then inspect exp, nbf, iat, and any claim warnings.
Example
Input
A three-part JWT whose payload contains sub, exp, nbf, and iat claims
Output
Formatted header and payload JSON, an expiration result, readable claim dates, and time-claim diagnostics.
What JWT Decoder & Expiration Checker returns
JWT Decoder & Expiration Checker is designed to decode a compact JWT into readable JSON and check its registered time claims against the current device clock.
Input: one three-part compact JWT up to 128 KiB, with an optional Bearer prefix and a clock tolerance from 0 to 300 seconds. Output: formatted header and payload JSON, expiration status, readable registered claims, and structural or time-claim diagnostics.
How JWT Decoder & Expiration Checker works
The browser removes an optional Bearer prefix, validates the compact segments as unpadded Base64URL, decodes UTF-8 JSON objects, and compares NumericDate seconds with the current device time plus the selected tolerance.
Confirm that the device clock is accurate, read NumericDate values as seconds rather than milliseconds, and compare issuer or audience values with the requirements of the application that consumes the token.
A useful situation for JWT Decoder & Expiration Checker
Use it when you are diagnosing why a client treats a session as expired, confirming a test fixture's time window, or reading claims copied from a local development response.
The workflow is intended for developers, API testers, support engineers, integration teams, and people troubleshooting login or session timing.
Limits and common errors
The result depends on the device clock and cannot know application-specific rules for issuer, audience, subject, revocation, session state, or maximum token age.
A common mistake is treating iat as an automatic validity boundary, overlooking a missing exp claim, or adding an excessive tolerance that hides a genuine expiry problem.
Privacy and the next step
The JWT is decoded and checked locally in the browser and is not uploaded, stored, or logged by TOOLFINA.
For a broader workflow, format copied JSON with the JSON formatter, check JSON fixtures with the validator, and inspect unrelated Base64 data with the Base64 previewer.
If the result matters later, record the test time, clock tolerance, relevant claims, and application environment when an expiration result is part of a reproducible bug report.
FAQ
How does the expiration check work?
The tool reads the exp NumericDate in seconds and compares it with the current time reported by this device. The token is expired when the current time reaches or passes exp, after applying any clock tolerance you entered.
What happens when a JWT has no exp claim?
The header and payload are still decoded, but the result says that no expiration boundary can be checked. The tool also reports nbf and iat when they are present.
Why can the result differ between two devices?
Expiration and not-before checks use each device's current clock. A wrong clock or a boundary only a few seconds away can change the result; use a small tolerance only when your system intentionally allows it.
Is JWT Decoder & Expiration Checker free to use?
Yes. The public JWT Decoder & Expiration Checker runs in the browser and does not require a sign-in for normal use.
How does JWT Decoder & Expiration Checker handle my input?
The JWT is decoded and checked locally in the browser and is not uploaded, stored, or logged by TOOLFINA.
What should I check before relying on the result?
Confirm that the device clock is accurate, read NumericDate values as seconds rather than milliseconds, and compare issuer or audience values with the requirements of the application that consumes the token. Also confirm that the input reflects the exact situation you are working on.
What is a common mistake with JWT Decoder & Expiration Checker?
A common mistake is treating iat as an automatic validity boundary, overlooking a missing exp claim, or adding an excessive tolerance that hides a genuine expiry problem. Review the original material and the final output before publishing or sharing it.
What should I use with JWT Decoder & Expiration Checker?
Format copied JSON with the JSON formatter, check JSON fixtures with the validator, and inspect unrelated Base64 data with the Base64 previewer. Related tools can help you check the same task from another angle.
Articles
Privacy note
The JWT is decoded and checked locally in your browser. TOOLFINA does not upload, store, or log the token.
This tool runs in your browser. TOOLFINA does not require an account for public tools.