IT Consulting
Illustration of a JWT token splitting into header and payload sections with an expiry countdown

JWT Expiry Checker

Paste a JWT below to decode its header/payload and check its expiry. Runs entirely in your browser — a token is a live credential, so nothing here is ever sent anywhere.

⚠️ This decodes the token — it does not verify the signature. A JWT's header and payload are plain base64url-encoded JSON, readable by anyone with the token; that a token decodes cleanly here proves nothing about whether it's genuine. Verifying a signature requires the issuer's secret or public key.
ℹ️ How this works
  • A JWT is header.payload.signature, each part (except the signature) base64url-encoded JSON. Decoding just reverses that encoding — no cryptography involved.
  • exp (expiration), iat (issued at), and nbf (not before) are read as Unix timestamps (seconds) per the JWT spec, when present.
  • Runs entirely client-side on this page — nothing you paste here is ever sent anywhere. The JSON API below is a separate, opt-in endpoint for scripts, with the same decode-only caveat.
💻 Show API usage example (cURL) 
curl -sS "https://devops.majbase.com/jwt-checker/api" \
    --data-urlencode 'token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....'

Returns {"header", "payload", "time_claims", "expiry_status": {"expired","diff_seconds"}|null, "not_before_status": {"active","diff_seconds"}|null, "has_signature"}, or {"error": "..."} for a malformed token. Decode only — the signature is never verified.