How to Check if a JWT Is Expired

An API that worked a minute ago now returns 401 Unauthorized. The most common cause is an expired token. A JWT carries its own expiry time, so you can check it in seconds without touching the server.

Hands coding on a laptop

Where the expiry lives

A JSON Web Token has three parts separated by dots: header, payload and signature. The payload holds claims, and three of them are about time:

exp — expiration time. After this moment the token must be rejected.
iat — issued at. When the token was created.
nbf — not before. The token isn't valid until this time.

All three are Unix timestamps: seconds since 1 January 1970 UTC, such as 1791763200.

How to check if a JWT is expired

Copy the token (from the Authorization: Bearer … header, your browser storage or your logs).
Paste it into the free JWT Decoder. The header and payload appear as readable JSON.
Find the exp value in the payload and copy the number.
Paste it into the Timestamp Converter to see the date and time it represents.
Compare it with the current time. If exp is in the past, the token has expired.

Both tools run in your browser, so the token is never sent to a server — important, because a valid JWT is a password to your account.

Code on a computer screen

Working out the token's lifetime

Subtract iat from exp to get the lifetime in seconds: 3,600 is one hour, 900 is 15 minutes, 86,400 is one day. Short-lived access tokens (5–60 minutes) paired with longer refresh tokens are the usual pattern.

Still getting 401 with a valid exp?

Clock skew: if the server's clock is ahead of the one that issued the token, it may treat it as expired early. Most libraries allow 30–60 seconds of leeway.
Milliseconds vs seconds: exp must be in seconds. A 13-digit number is milliseconds — a common bug.
nbf in the future: the token isn't valid yet.
Wrong audience or issuer: check aud and iss.
Revoked or rotated keys: the signature no longer verifies.

FAQ

Does decoding a JWT verify it? No. Decoding only reads the payload. Verification checks the signature with the secret or public key, and must happen on the server.

Can I change exp to extend a token? No. Changing any part of the payload breaks the signature.

Try it now

Decode your token with the free JWT Decoder.