Verificador de Expiração JWT
Cole um JWT para decodificar sua carga útil e verificar se está expirado, ainda não válido ou ativo — com os claims exp, nbf e iat convertidos de tempo Unix para UTC ISO 8601 legível. O token é decodificado no seu navegador e nunca é enviado.
Entrada
Apenas a carga útil é decodificada — a assinatura não é verificada. O token permanece no seu navegador.
O instante para avaliar o token. Insira Unix seconds (ex: 1704067200) ou uma data ISO 8601 (ex: 2024-01-01T00:00:00Z). Deixe em branco para usar a hora atual.
Saída
| Claim | Valor Bruto | UTC (ISO 8601) | Observação |
|---|---|---|---|
| No data yet | |||
Guias
Check whether a JWT is expired, active, or not yet valid
A JSON Web Token (JWT) carries its own validity window inside three registered time claims: exp (expiration), nbf (not-before), and iat (issued-at). Those values are stored as raw Unix timestamps — seconds since 1 January 1970 — which are impossible to read at a glance. The JWT Expiry Checker decodes the token's payload, pulls out those claims, and converts each one into a human-readable ISO 8601 UTC timestamp, then tells you in plain English whether the token is currently valid, expired, or not yet valid.
It is the fast answer to the everyday question "is this token still good?" without reaching for a debugger, a script, or an online decoder that ships your token to a server.
How to use it
- Paste your JWT into the JWT Token box. A JWT has three dot-separated segments:
header.payload.signature. - Optionally set a Reference Time (now) — either Unix seconds (e.g.
1704067200) or an ISO 8601 date (e.g.2024-01-01T00:00:00Z). Leave it blank to evaluate the token against the current clock. - Read the Status line for the verdict, and the Time Claims table for each claim's raw value, its UTC equivalent, and a note such as "expires in 1h" or "expired 3d ago".
The reference-time field is what lets you answer "was this token valid at 2pm yesterday?" or reproduce a check exactly — handy when debugging clock-skew and "token expired too early" issues.
Why isn't the signature verified?
This tool inspects the timing of a token, not its authenticity. Verifying a signature requires the issuer's secret or public key, which the checker never asks for. A token can be perfectly within its validity window and still be forged — always verify signatures server-side before trusting a token.
What does "not yet valid" mean?
If a token carries an nbf (not-before) claim set to a future time, it must not be accepted until that moment arrives. The checker flags this state separately from "expired" so you can tell a premature token apart from a stale one.
What if the token has no exp claim?
Not every JWT expires. When there is no exp claim, the token is reported as valid with a note that it has no expiration — which is itself worth knowing, since non-expiring tokens are a security concern.
Which timezone are the dates in?
All timestamps are shown in UTC (ISO 8601, ending in Z). Unix time is timezone-independent, so UTC is the unambiguous way to display it.
Privacy
The JWT Expiry Checker runs entirely in your browser. Your token is decoded locally with JavaScript and is never uploaded, logged, or sent anywhere. You can paste production tokens safely — nothing leaves your machine.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/jwt-expiry-checker \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI…",
"referenceTime": "1704067200"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `jwt-expiry-checker` tool (JWT Expiry Checker) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.