JWT Validator

Verify JWT structure and check Expiration (exp) status instantly.

Is this token well-formed, and has it expired?

When an API suddenly returns 401, the first questions are simple: is the token even shaped correctly, and has its lifetime run out? The JWT Validator answers both. It splits the token, decodes the payload, reads the exp claim and compares it with the current time on your device, then tells you in large text whether the token is active or expired and shows the date.

Checking a token

Paste your token into the input box, or press Sample to load an example whose expiry is long in the past.
Click Process / Generate.
Read the verdict in the results panel. Use Copy or Download to save it, or Clear to reset.

You will see one of four outcomes:

VALID & ACTIVE with the date and time the token expires, shown in your local time zone.
EXPIRED with the date it lapsed.
NO EXPIRATION, meaning the payload is readable but has no exp field.
An error stating the token is not valid, when it lacks three segments or the payload cannot be decoded.

What validity means here

The word valid in this tool is narrow: the token has three parts, the payload is decodable JSON, and the expiry time, if any, is still in the future. It does not verify the signature, so it cannot tell whether the token was issued by your server or forged. It also ignores other claims such as nbf (not before), iss (issuer) and aud (audience), and it does not inspect the header. A token can show as active here and still be rejected by your API for any of those reasons.

Helpful scenarios

Diagnosing a sudden 401 by confirming that the access token really has expired.
Checking how long a freshly issued token will live during development.
Spotting tokens that have no expiry at all, which is a common configuration risk.
Comparing lifetimes between environments when session timeouts seem inconsistent.

Edge cases

The comparison uses your device clock. If your computer's time is wrong by minutes or hours, the verdict may be too, and servers often allow some clock leeway that this tool does not. The exp claim must be a number of seconds since 1970, which is the JWT standard. Non-Latin characters in the payload will not affect the expiry check, though they may not decode cleanly. The check happens in your browser page.

Related Tools

Frequently Asked Questions

Does this tool verify the token's signature?

No. It checks that the token has three parts, that the payload decodes as JSON, and whether the exp time has passed. It cannot tell if the token is genuine, so a forged token can still show as valid and active.

What does NO EXPIRATION mean?

The token is structurally readable, but its payload has no exp claim. Such a token never expires on its own, which can be risky for access tokens. Check whether your issuer should be adding an expiry.

Which time zone is the expiry shown in?

The date is formatted in your device's local time zone and locale, using your device clock as the current time. If your clock is wrong, the verdict may be wrong, and servers may also allow a small leeway that this tool does not.

Why does my token show active but my API rejects it?

The API may check things this tool ignores: signature, audience, issuer, not-before time, revocation lists or scopes. Use the JWT Decoder to inspect those claims, and check the server's logs for the exact reason.

What if I see Token is NOT valid?

The text either does not have exactly three dot-separated parts or the middle part cannot be decoded as JSON. Remove any Bearer prefix or whitespace, and confirm the whole token was copied without truncation.