Pemeriksa Kedaluwarsa JWT
Tempel JWT untuk mendekode muatannya dan periksa apakah sudah kadaluarsa, belum berlaku, atau aktif — dengan klaim exp, nbf dan iat dikonversi dari waktu Unix ke UTC ISO 8601 yang mudah dibaca. Token didekode di browser Anda dan tidak pernah diunggah.
Input
Hanya muatan yang didekode — tanda tangan tidak diverifikasi. Token tetap ada di browser Anda.
Instant untuk mengevaluasi token. Masukkan Unix seconds (cth. 1704067200) atau tanggal ISO 8601 (cth. 2024-01-01T00:00:00Z). Biarkan kosong untuk menggunakan waktu saat ini.
Output
| Klaim | Nilai Mentah | UTC (ISO 8601) | Catatan |
|---|---|---|---|
| No data yet | |||
Cara lain menggunakan alat ini
REST API
curl -X POST https://api.iotools.cloud/v1/tool/jwt-expiry-checker \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI…",
"referenceTime": "1704067200"
}'Ganti dengan kunci Anda sendiri dari akun Anda. Bidang alat menjadi isi permintaan — tanpa pembungkus.
Tanyakan ke agen AI
Use the IOTools `jwt-expiry-checker` tool (JWT Expiry Checker) on this input:
YOUR_INPUT_HERETempelkan ini ke agen mana pun yang terhubung ke server MCP IOTools, lalu tambahkan input Anda.
Widget sematan
<iframe
src="https://iotools.cloud/embed/jwt-expiry-checker/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="Pemeriksa Kedaluwarsa JWT — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Tempelkan ini di halaman Anda sendiri — gratis, tanpa kunci, cukup tautan balik.
| Biaya per panggilan API/MCP | Mulai dari 5 kredit |
|---|---|
| Butuh kredit lebih? | Lihat harga |
Juga tersedia melalui
Panduan
Check whether a JWT is expired, active, or not yet valid
A JSON Web Token (JWT) carries its own validity window inside three registered time claims: exp (expiration), nbf (not-before), and iat (issued-at). Those values are stored as raw Unix timestamps — seconds since 1 January 1970 — which are impossible to read at a glance. The JWT Expiry Checker decodes the token's payload, pulls out those claims, and converts each one into a human-readable ISO 8601 UTC timestamp, then tells you in plain English whether the token is currently valid, expired, or not yet valid.
It is the fast answer to the everyday question "is this token still good?" without reaching for a debugger, a script, or an online decoder that ships your token to a server.
How to use it
- Paste your JWT into the JWT Token box. A JWT has three dot-separated segments:
header.payload.signature. - Optionally set a Reference Time (now) — either Unix seconds (e.g.
1704067200) or an ISO 8601 date (e.g.2024-01-01T00:00:00Z). Leave it blank to evaluate the token against the current clock. - Read the Status line for the verdict, and the Time Claims table for each claim's raw value, its UTC equivalent, and a note such as "expires in 1h" or "expired 3d ago".
The reference-time field is what lets you answer "was this token valid at 2pm yesterday?" or reproduce a check exactly — handy when debugging clock-skew and "token expired too early" issues.
Why isn't the signature verified?
This tool inspects the timing of a token, not its authenticity. Verifying a signature requires the issuer's secret or public key, which the checker never asks for. A token can be perfectly within its validity window and still be forged — always verify signatures server-side before trusting a token.
What does "not yet valid" mean?
If a token carries an nbf (not-before) claim set to a future time, it must not be accepted until that moment arrives. The checker flags this state separately from "expired" so you can tell a premature token apart from a stale one.
What if the token has no exp claim?
Not every JWT expires. When there is no exp claim, the token is reported as valid with a note that it has no expiration — which is itself worth knowing, since non-expiring tokens are a security concern.
Which timezone are the dates in?
All timestamps are shown in UTC (ISO 8601, ending in Z). Unix time is timezone-independent, so UTC is the unambiguous way to display it.
Privacy
The JWT Expiry Checker runs entirely in your browser. Your token is decoded locally with JavaScript and is never uploaded, logged, or sent anywhere. You can paste production tokens safely — nothing leaves your machine.