What is the JWT exp claim?
A JWT (JSON Web Token) has three parts separated by dots: header.payload.signature. The payload carries claims — and exp is the "expiration time" claim: a Unix timestamp (seconds since 1 January 1970) after which the token must no longer be accepted. Checking exp is the standard way to answer "when does this token expire?"
How to check JWT token expiry manually, without code
- Open the JWT Decoder tool.
- Paste your full token (the three dot-separated parts) into the input.
- Read the decoded payload — find the
expclaim. - The tool converts the
expUnix timestamp into a human-readable expiry date and time automatically. - Compare with the current time: if
expis in the past, the token is expired.
JWT exp claim: convert Unix timestamp to date online
If all you have is the raw exp number (e.g. 1760659200), paste it into the Timestamp Converter — it turns any Unix timestamp into a readable date in both UTC and your local time, handling seconds and milliseconds automatically.
Honest limit: decoding is not verifying
Decoding shows you the claims, but it does not verify the token's signature — anyone can read a JWT's payload. Real verification needs the signing secret or public key on your server. Use the decoder for inspection and debugging, never as proof a token is genuine.
Frequently asked questions
How do I check when a JWT expires?
Paste the token into a free JWT decoder. It decodes the payload and converts the exp claim into a readable expiry date — if that date is in the past, the token is expired.
What is the exp claim in a JWT?
exp is the standard 'expiration time' claim: a Unix timestamp in seconds. Servers reject the token once the current time passes exp.
How do I convert a JWT exp timestamp to a date online?
Paste the exp number into a Unix timestamp converter — it shows the date in UTC and local time. Or paste the whole token into the JWT decoder, which does it automatically.
Does decoding a JWT verify its signature?
No. Decoding only reads the payload — it proves nothing about authenticity. Verifying a signature requires the secret or public key, which only your server should hold.
What if my token has no exp claim?
Then it never expires by time — some tokens rely on other means (short lifetimes, revocation lists, or the nbf/iat claims). For sessions, a missing exp is usually a security smell worth fixing.
Is my token uploaded anywhere when I decode it?
No. Decoding happens entirely in your browser — your token never leaves your device. Still, avoid pasting production secrets into any online tool as a habit.
Try it now
Ready? Check your JWT's expiry free — no signup, tokens never leave your browser.