JWT expiry visual timeline
Paste a JWT and see its full lifecycle on a timeline — issued, not-before, expiry, and whether it's currently active.
About this tool
Paste a JWT and see its issued-at, not-before, and expiry timestamps plotted on a visual timeline. Instantly know if a token is active, expired, or not yet valid — with all claims decoded inline.
- 1
Paste your JWT into the input box.
- 2
The header, payload, and signature are decoded and displayed.
- 3
The visual timeline shows iat (issued), nbf (not before), exp (expiry), and the current time.
- 4
Token status (Active, Expired, Not yet valid) is shown prominently at the top.
Debug an authentication issue by checking whether a JWT is already expired.
Verify the iat and exp of a token returned from a new auth flow.
Understand the nbf claim and why a freshly issued token might be rejected.
Share a decoded token view with a colleague for debugging without revealing the signing secret.
Sample JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cDecoded payload with iat: 2018-01-18Invalid JWT format
Cause: A JWT must have exactly three Base64URL-encoded segments separated by dots.
Fix: Make sure you paste the complete token. Tokens copied from DevTools or API responses sometimes have leading/trailing whitespace — trim it and try again.
No exp claim found
Cause: The token payload does not contain an exp (expiry) field. Not all JWTs have an expiry.
Fix: The timeline will still show iat and nbf if present. Check with your token issuer whether expiry is set.
These answers explain common jwt timeline tasks, expected input formats, and edge cases so both visitors and search engines can understand what this tool does.
Is the JWT signature verified?
No. Signature verification requires the secret or public key, which this tool does not ask for. The tool only decodes the header and payload (which are public Base64URL data). Never share tokens containing sensitive user data.
What timestamp claims are visualised?
iat (issued at), nbf (not before), and exp (expiration). All are standard JWT registered claims defined in RFC 7519. If any are missing from the token, the timeline omits that marker.
Are token contents sent to a server?
No. Decoding is done entirely in JavaScript in your browser. The token never leaves your machine.
How is the current time shown on the timeline?
A 'now' marker is placed on the timeline relative to iat and exp. The token status — Active, Expired, or Not yet valid — is derived by comparing the current Unix timestamp to nbf and exp.