Developer tools
How to check JWT expiry before using a token
Learn how to read the exp claim in a JWT, check expiry against the current time, and handle tokens that are near expiration.
Document summary
A guide to reading the exp claim in JWT tokens, checking expiry locally, and handling tokens that are about to expire.
Key takeaways
- The exp claim is a Unix timestamp in seconds
- Expired tokens must be rejected, not retried
- Check expiry locally before debugging anything else
What the exp claim means
The exp (expiration time) claim is a Unix timestamp in seconds since the epoch. A token is valid only while the current time is earlier than exp, with the clock skew your system allows.
Missing exp is a warning sign: tokens without expiry never rotate, which is dangerous for long-lived sessions.
Check a token locally
- 1
Open the JWT expiry checker and paste the token.
- 2
The tool decodes the payload locally and shows the exp value as a readable date.
- 3
Compare it with the current time and the clock-skew allowance.
- 4
Decide: use the token, refresh it, or request a new one.
Handle near-expiry tokens in code
- Refresh before expiry, not after a failed request
- Treat expiry errors as expected flows, not exceptions
- Never extend exp client-side; only the issuer can re-sign
When a token fails unexpectedly
If an API rejects a token, check expiry first with the checker, then the signature with the JWT decoder. Expiry is the most common cause of intermittent 401s, especially across time zones and clock drift.
Frequently asked questions
What does exp mean in a JWT?
exp is the expiration time claim, a Unix timestamp in seconds after which the token must not be accepted.
Can I extend the expiry of a token?
No. Only the issuer, who holds the signing key, can issue a new token with a new exp.
Why does my token expire early?
Check the clock on both sides. Clock skew between your server and the issuer is a common cause.
Is my token uploaded?
No. The checker decodes the payload locally in your browser.
