What is JWT expiration (the exp claim)?
The exp claim is a Unix timestamp after which a JWT is invalid. Learn how JWT expiry works and decode a token to read its exp free.
The exp ("expiration time") claim in a JWT is a Unix timestamp after which the token must be rejected. It limits how long a stolen token stays useful and is the main reason JWTs are given short lifetimes.
How exp limits risk
Because a JWT is a bearer credential anyone holding it can use, its exp claim caps the damage of a leak: after that moment, servers reject it. Short-lived access tokens (minutes) paired with a separate refresh mechanism are the common pattern — the access token expires fast, and a refresh token mints a new one.
Reading and checking exp
exp is seconds since 1970 (UTC). Decode a JWT to see it, and convert it with a timestamp tool to a readable date. Servers should always verify exp — plus iat (issued-at) and nbf (not-before) — not just the signature.
Try it now — free, no signup
Use the JWT decoder in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.