header.payload.signature
JWT Expiration Checker
Drop in a JWT to see exactly when it was issued, when it becomes valid, and when it expires — with a clear valid / expiring soon / expired status.
Quick Answers
- Is it safe to paste a production JWT access token here?
- Yes. Decoding happens entirely in your browser using JavaScript — the token is never transmitted to any server, logged, or stored. You can verify this by checking your browser's network tab while using the tool.
- Can this tool verify the signature, or only decode?
- This tool decodes and inspects the header and payload, and checks the expiration claim locally. It does not verify the cryptographic signature, since that would require the signing secret or public key, which you should never paste into a third-party website.
- Why does my token show 'expired' even though it still works in my app?
- Some backends deliberately allow a grace period ('leeway') after the exp timestamp passes, or don't check expiration at all. This tool reports the raw exp claim compared to your current system clock.
All decoding happens entirely in your browser. No data is ever sent to a server — nothing you paste here is transmitted, logged, or stored.
Frequently asked questions
Is it safe to paste a production JWT access token here?
Yes. Decoding happens entirely in your browser using JavaScript — the token is never transmitted to any server, logged, or stored. You can verify this by checking your browser's network tab while using the tool.
Can this tool verify the signature, or only decode?
This tool decodes and inspects the header and payload, and checks the expiration claim locally. It does not verify the cryptographic signature, since that would require the signing secret or public key, which you should never paste into a third-party website.
Why does my token show 'expired' even though it still works in my app?
Some backends deliberately allow a grace period ('leeway') after the exp timestamp passes, or don't check expiration at all. This tool reports the raw exp claim compared to your current system clock.
What's the difference between the header, payload, and signature?
The header describes the token type and signing algorithm. The payload holds the claims — the actual data, like user ID or expiry. The signature is a cryptographic hash of the header and payload used to verify the token wasn't tampered with.
Related tools