What does the JWT exp claim mean?

The exp claim is a NumericDate showing the time after which a JWT must not be accepted. The server should compare it with the current Unix time.

Can a client validate JWT expiration safely?

A client can use exp to update its interface, but only a trusted backend can enforce authorization. Client-side expiration checks must never replace server verification.

What happens when a JWT expires?

The API should reject it and usually return an authentication error. The client may use a valid refresh-token flow to request a new access token.

How to Validate JWT Expiration: exp Claim and Examples

What is JWT expiration?

JWT expiration is controlled by the exp registered claim. It is a Unix timestamp in seconds, not milliseconds. After that time, a resource server should reject the token even if its signature is valid.

You can inspect the claim with the DevToolkit JWT Decoder, but inspection alone is not validation. Read how JWTs work to understand the difference between decoding and verification.

Validate `exp` in JavaScript

This helper checks the timestamp after a trusted verification step has already taken place:

function isExpired(payload, nowSeconds = Math.floor(Date.now() / 1000)) {
  return typeof payload.exp !== "number" || payload.exp <= nowSeconds;
}

An application should not accept a token merely because this function returns false. The server must first validate the signature, issuer, audience, and allowed algorithm.

Validate expiration in Python

With a JWT library, verification and expiration checking should happen together:

import jwt

payload = jwt.decode(
    token,
    public_key,
    algorithms=["RS256"],
    issuer="https://auth.example.com",
    audience="api",
)

Trusted libraries reject expired tokens and invalid signatures when configured correctly. Do not disable expiration verification in production simply to make a test pass.

Common expiration mistakes

Treating seconds as milliseconds

exp is normally expressed in seconds. Comparing it directly with Date.now() produces an incorrect result because JavaScript returns milliseconds.

Accepting missing expiration

If your application requires short-lived tokens, reject tokens without an exp claim instead of treating them as permanent.

Ignoring clock skew

Different servers may disagree by a few seconds. A small, explicit leeway can prevent failures at the boundary, but excessive leeway weakens the expiration policy.

Refreshing in a loop

When a refresh token is invalid or revoked, repeated refresh attempts can create a request loop. Stop after one failed refresh and require the user to authenticate again.

Access tokens and refresh tokens

Access tokens should normally be short-lived and sent to APIs. Refresh tokens are used only with the authorization server to obtain a new access token. Store refresh tokens with stronger protections, such as an HttpOnly and Secure cookie where appropriate.

Debug an expired token

When troubleshooting, inspect iat, nbf, and exp, confirm the server's current time, and check that the token came from the expected environment. Use the JWT Decoder for inspection and never paste real production credentials into shared tools.

Summary

JWT expiration is a server-side security rule based on the exp timestamp in seconds. Validate it together with the signature, issuer, audience, and algorithm. A browser can display expiration status, but only the backend should decide whether a request is authorized.