JWT Expiry (exp/nbf/iat) Validator
Validate a JWT token timestamps (exp, nbf and iat) and find out if it is expired or not yet valid. Useful for debugging auth, without verifying the signature.
Validade
—
When a token expires, and why
The API answers 401 and you cannot tell whether the token is stale or the permissions are wrong. The JWT sits there, three hundred characters of base64, and nobody reads epoch seconds by eye. Pasting it into a full decoder feels like overkill when you only want one answer: has this token expired, has it not started yet, and how long ago was it issued?
The token is split on the dots, the second chunk (the payload) is decoded from base64url, and the three time claims are compared against your computer clock. exp is the moment the token dies, nbf the moment it starts being accepted, and iat when it was issued, all in seconds since 1970 rather than milliseconds, which is the classic slip when tokens are minted in JavaScript. An iat in the future is flagged as suspicious.
Two caveats. The comparison uses your device clock, so a machine running fast will show a live token as expired, the same class of bug that bites in production when servers drift apart. And the signature is never checked: a token can be both expired and forged, and only the timing shows up here. Nothing leaves the browser, but think twice before pasting production tokens that are still alive into any web page.
Frequently asked questions
What is the difference between exp, nbf and iat?
Does this verify the JWT signature?
Why does my token show as expired when the API still accepts it?
Related Tools
Cron Expression Validator
Validate a cron expression (5 or 6 fields) and indicate which field is wrong. Accepts lists, ranges and steps.
OpenAPI Validator
Paste an OpenAPI 3.x document (YAML or JSON) and check required fields (info, paths, openapi). Lists errors and operation count.
TOML Validator
Verify whether TOML content is syntactically valid. Error messages with line and column.
CSS Selector Validator
Verify whether a CSS selector is valid and compute its specificity (a,b,c). Lists detected classes, IDs and elements.
Base32 Validator
Check whether a string is valid Base32 (RFC 4648). Accepts = padding. Shows payload size in bytes.
Base64 Validator
Check whether a string is valid Base64 (with or without padding). Shows decoded size and whether content looks like UTF-8 or binary.