Verificador de Expiração JWT
Cole um JWT para decodificar sua carga útil e verificar se está expirado, ainda não válido ou ativo — com os claims exp, nbf e iat convertidos de tempo Unix para UTC ISO 8601 legível. O token é decodificado no seu navegador e nunca é enviado.
Entrada
Apenas a carga útil é decodificada — a assinatura não é verificada. O token permanece no seu navegador.
O instante para avaliar o token. Insira Unix seconds (ex: 1704067200) ou uma data ISO 8601 (ex: 2024-01-01T00:00:00Z). Deixe em branco para usar a hora atual.
Saída
| Claim | Valor Bruto | UTC (ISO 8601) | Observação |
|---|---|---|---|
| No data yet | |||
Mais formas de usar esta ferramenta
API REST
curl -X POST https://api.iotools.cloud/v1/tool/jwt-expiry-checker \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI…",
"referenceTime": "1704067200"
}'Troque pela sua própria chave, da sua conta. Os campos da ferramenta viram o corpo da requisição — sem envelope.
Peça a um agente de IA
Use the IOTools `jwt-expiry-checker` tool (JWT Expiry Checker) on this input:
YOUR_INPUT_HERECole isto em qualquer agente conectado ao servidor MCP do IOTools e depois adicione sua entrada.
Widget para incorporar
<iframe
src="https://iotools.cloud/embed/jwt-expiry-checker/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="Verificador de Expiração JWT — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Coloque isso na sua própria página — grátis, sem chave, só um link de volta.
| Custo por chamada de API/MCP | A partir de 5 créditos |
|---|---|
| Precisa de mais créditos? | Ver preços |
Também disponível via
Guias
Check whether a JWT is expired, active, or not yet valid
A JSON Web Token (JWT) carries its own validity window inside three registered time claims: exp (expiration), nbf (not-before), and iat (issued-at). Those values are stored as raw Unix timestamps — seconds since 1 January 1970 — which are impossible to read at a glance. The JWT Expiry Checker decodes the token's payload, pulls out those claims, and converts each one into a human-readable ISO 8601 UTC timestamp, then tells you in plain English whether the token is currently valid, expired, or not yet valid.
It is the fast answer to the everyday question "is this token still good?" without reaching for a debugger, a script, or an online decoder that ships your token to a server.
How to use it
- Paste your JWT into the JWT Token box. A JWT has three dot-separated segments:
header.payload.signature. - Optionally set a Reference Time (now) — either Unix seconds (e.g.
1704067200) or an ISO 8601 date (e.g.2024-01-01T00:00:00Z). Leave it blank to evaluate the token against the current clock. - Read the Status line for the verdict, and the Time Claims table for each claim's raw value, its UTC equivalent, and a note such as "expires in 1h" or "expired 3d ago".
The reference-time field is what lets you answer "was this token valid at 2pm yesterday?" or reproduce a check exactly — handy when debugging clock-skew and "token expired too early" issues.
Why isn't the signature verified?
This tool inspects the timing of a token, not its authenticity. Verifying a signature requires the issuer's secret or public key, which the checker never asks for. A token can be perfectly within its validity window and still be forged — always verify signatures server-side before trusting a token.
What does "not yet valid" mean?
If a token carries an nbf (not-before) claim set to a future time, it must not be accepted until that moment arrives. The checker flags this state separately from "expired" so you can tell a premature token apart from a stale one.
What if the token has no exp claim?
Not every JWT expires. When there is no exp claim, the token is reported as valid with a note that it has no expiration — which is itself worth knowing, since non-expiring tokens are a security concern.
Which timezone are the dates in?
All timestamps are shown in UTC (ISO 8601, ending in Z). Unix time is timezone-independent, so UTC is the unambiguous way to display it.
Privacy
The JWT Expiry Checker runs entirely in your browser. Your token is decoded locally with JavaScript and is never uploaded, logged, or sent anywhere. You can paste production tokens safely — nothing leaves your machine.