What this tool does
Paste a token and immediately see whether it's expired, valid, or not yet active — with a live, ticking countdown to (or since) its exp claim, rather than a single static badge. Useful for quickly answering "did this request fail because the token expired?" without digging through the full payload.
How the status is determined
- Expired — the current time is at or past the
exp(expiration) claim. - Not yet valid — the token has an
nbf(not-before) claim that hasn't been reached yet. This takes priority overexp, since a token can't be both not-yet-active and already expired. - Valid — the current time falls between
nbf(if present) andexp. - No expiration set — there's no
expclaim at all, meaning the token has no built-in expiry and stays valid until something outside the token itself revokes it.
All three time claims — iat (issued-at), nbf, and exp — are RFC 7519 registered claims expressed as Unix timestamps (seconds since the epoch), which is why they need decoding to be human-readable in the first place.
FAQ
Does this verify the signature?
No — this tool only decodes and reads the time claims, it doesn't check whether the token was actually signed by who it claims. If you need signature verification and a broader set of security checks, use the JWT Inspector instead.
I want to see the full header and payload
The JWT Decoder shows the complete decoded header and payload alongside the same expiration check.
Is my token uploaded anywhere?
No — decoding happens entirely in your browser. Nothing is sent to a server.