JWT expiration check — decode tokens locally

Paste any JWT (id token, access token, session cookie value) to see its claims and expiry status. Decoding happens entirely in your browser — the token never leaves this page.

How JWT expiry works

A JWT carries its expiry as the exp claim — a Unix timestamp (seconds since 1970) after which the token must be rejected. When a request fails with 401 Unauthorized, an expired exp is the first thing to check:

1. Decode the token (this page — no server needed).
2. Compare exp against the current time.
3. If expired: refresh the token or re-authenticate — the API will keep rejecting it.
4. Also check iat (issued at) and nbf (not before) for clock-skew problems.

Does this validate the signature?

No — and it should not need to. Decoding shows what the token claims; only the issuing server can prove the signature is genuine. Never trust a decoded JWT from an untrusted source — but for debugging your own tokens, decoding locally is the fastest tool there is.

Is my token uploaded anywhere?

No. This page is a single static HTML file. Base64url decoding runs in your browser's JavaScript engine — you can disconnect from the internet after the page loads.

Need the full toolbox?

This page is one tool from LocalDevToolbox — 15+ local developer tools: context optimizer, stack trace analyzer, log doctor, cURL converter and more.