Проверка срока действия JWT
Вставьте JWT для декодирования его полезной нагрузки и проверки, истек ли он, еще не активен или активен — с преобразованием заявлений exp, nbf и iat из времени Unix в читаемый формат UTC ISO 8601. Токен декодируется в вашем браузере и никогда не загружается.
Ввод
Декодируется только полезная нагрузка — подпись не проверяется. Токен остается в вашем браузере.
Момент времени для оценки токена. Введите Unix seconds (например, 1704067200) или дату в формате ISO 8601 (например, 2024-01-01T00:00:00Z). Оставьте пусто для использования текущего времени.
Вывод
| Заявление | Исходное значение | UTC (ISO 8601) | Примечание |
|---|---|---|---|
| No data yet | |||
Другие способы использовать этот инструмент
REST API
curl -X POST https://api.iotools.cloud/v1/tool/jwt-expiry-checker \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI…",
"referenceTime": "1704067200"
}'Подставьте свой собственный ключ из аккаунта. Поля инструмента — это тело запроса, без обёртки.
Спросите у ИИ-агента
Use the IOTools `jwt-expiry-checker` tool (JWT Expiry Checker) on this input:
YOUR_INPUT_HEREВставьте это любому агенту, подключённому к MCP-серверу IOTools, и добавьте свой ввод.
Виджет для встраивания
<iframe
src="https://iotools.cloud/embed/jwt-expiry-checker/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="Проверка срока действия JWT — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Вставьте это на свою страницу — бесплатно, без ключа, нужна лишь обратная ссылка.
| Стоимость вызова API/MCP | От 5 кредитов |
|---|---|
| Нужно больше кредитов? | Посмотреть тарифы |
Также доступно через
Руководства
Check whether a JWT is expired, active, or not yet valid
A JSON Web Token (JWT) carries its own validity window inside three registered time claims: exp (expiration), nbf (not-before), and iat (issued-at). Those values are stored as raw Unix timestamps — seconds since 1 January 1970 — which are impossible to read at a glance. The JWT Expiry Checker decodes the token's payload, pulls out those claims, and converts each one into a human-readable ISO 8601 UTC timestamp, then tells you in plain English whether the token is currently valid, expired, or not yet valid.
It is the fast answer to the everyday question "is this token still good?" without reaching for a debugger, a script, or an online decoder that ships your token to a server.
How to use it
- Paste your JWT into the JWT Token box. A JWT has three dot-separated segments:
header.payload.signature. - Optionally set a Reference Time (now) — either Unix seconds (e.g.
1704067200) or an ISO 8601 date (e.g.2024-01-01T00:00:00Z). Leave it blank to evaluate the token against the current clock. - Read the Status line for the verdict, and the Time Claims table for each claim's raw value, its UTC equivalent, and a note such as "expires in 1h" or "expired 3d ago".
The reference-time field is what lets you answer "was this token valid at 2pm yesterday?" or reproduce a check exactly — handy when debugging clock-skew and "token expired too early" issues.
Why isn't the signature verified?
This tool inspects the timing of a token, not its authenticity. Verifying a signature requires the issuer's secret or public key, which the checker never asks for. A token can be perfectly within its validity window and still be forged — always verify signatures server-side before trusting a token.
What does "not yet valid" mean?
If a token carries an nbf (not-before) claim set to a future time, it must not be accepted until that moment arrives. The checker flags this state separately from "expired" so you can tell a premature token apart from a stale one.
What if the token has no exp claim?
Not every JWT expires. When there is no exp claim, the token is reported as valid with a note that it has no expiration — which is itself worth knowing, since non-expiring tokens are a security concern.
Which timezone are the dates in?
All timestamps are shown in UTC (ISO 8601, ending in Z). Unix time is timezone-independent, so UTC is the unambiguous way to display it.
Privacy
The JWT Expiry Checker runs entirely in your browser. Your token is decoded locally with JavaScript and is never uploaded, logged, or sent anywhere. You can paste production tokens safely — nothing leaves your machine.