What is the JWT expiration time?

It is the exp (expiration time) claim in the token payload: the time on or after which the token must not be accepted. RFC 7519 makes exp optional, so a token without it never expires unless the server enforces its own maximum age.

In what units is the JWT exp claim?

Seconds. exp, iat and nbf are NumericDate values — seconds since 1970-01-01T00:00:00 UTC, ignoring leap seconds. They are not milliseconds, even though JavaScript Date.now() and Java System.currentTimeMillis() return milliseconds.

How do I convert a JWT exp to a date?

Treat it as Unix seconds. In JavaScript use new Date(exp * 1000); in Python datetime.fromtimestamp(exp, tz=timezone.utc); in C# DateTimeOffset.FromUnixTimeSeconds(exp). For example, exp 1790943300 is 2026-10-02 12:15:00 UTC. Or paste the token into the calculator above.

How do I calculate the JWT expiration time from iat?

exp = iat + lifetime in seconds. A 15-minute token issued at 1790942400 (2026-10-02 12:00:00 UTC) gets exp 1790942400 + 900 = 1790943300. A 24-hour token adds 86,400 and a 7-day token adds 604,800.

What is iat in a JWT, and is it an epoch timestamp?

Yes. iat (issued at) is the time the token was created, as Unix epoch seconds like exp. It lets a server work out the token’s age. It does not make the token expire by itself — only exp (or a server-side maximum age check) does.

What does expiresIn 300 or 86400 mean?

In Node’s jsonwebtoken a number is seconds: expiresIn: 300 is 5 minutes and expiresIn: 86400 is 24 hours. Auth0 and OAuth expires_in responses are also seconds, so expires_in 86400 means the access token lasts one day.

What is 86400000 in JWT expiration?

86,400,000 milliseconds = 86,400 seconds = 24 hours (1d). Spring and Java projects often store jwt.expiration=86400000 or ${jwt_expiration_ms:86400000} and compute new Date(System.currentTimeMillis() + expiration). The resulting exp claim is still written in seconds.

How many seconds is a 15-minute JWT token?

900 seconds (900,000 milliseconds). In jsonwebtoken use expiresIn: 900 or "15m"; the exp claim will be iat + 900.

What is 7 days in seconds for a JWT?

604,800 seconds, or 604,800,000 milliseconds. As a time-span string it is "7d". Seven days is a typical refresh-token or remember-me lifetime, not an access-token lifetime.

How do I set a JWT TTL of 15 days?

15 days = 1,296,000 seconds = 1,296,000,000 milliseconds. Use expiresIn: 1296000 or "15d" in jsonwebtoken, setExpirationTime('15d') in jose, or 1,296,000,000L in a Java millisecond setting.

How long should a JWT access token last?

Short. OWASP advises a short expiration time to limit token reuse, and identity providers default to 5 minutes (Keycloak, Spring Authorization Server) to 1 hour (Google, Firebase, Cognito, Okta). 15 minutes is a common choice. Pair access tokens with a refresh token that lasts days to weeks, is rotated and can be revoked.

What is the default JWT expiration time?

The JWT standard has no default, and libraries like jsonwebtoken add no exp unless you set one. Identity providers do: Auth0 access tokens 24 hours (86,400 s) and ID tokens 10 hours; Google, Firebase, Cognito and Okta 1 hour; Microsoft Entra 60–90 minutes; Keycloak and Spring Authorization Server 5 minutes.

Does a JWT token expire?

Only if it has an exp claim and the verifier checks it. Decoding a token without exp shows it is valid forever. A signed JWT cannot be shortened after it is issued, so you control lifetime when you create it — or revoke it with a denylist.

What is JWT clock skew or leeway?

A few seconds or minutes of tolerance for clocks that disagree between the issuer and the API. RFC 7519 allows “usually no more than a few minutes”. Defaults differ: .NET ClockSkew 5 minutes, Spring Security 60 seconds, and jsonwebtoken, jose, PyJWT, jjwt, golang-jwt and php-jwt 0 unless you set it.

Why does my JWT say expired right after I create it?

The usual causes: the server clock is ahead of the issuer (add 30–60 seconds of leeway and sync with NTP); expiresIn was passed as the string "3600", which jsonwebtoken reads as 3,600 milliseconds; or the lifetime was set in minutes where seconds were expected.

How can I tell if a timestamp is seconds or milliseconds?

Count the digits. Current Unix times in seconds have 10 digits (e.g. 1790942400); in milliseconds they have 13 (e.g. 1790942400000). Microseconds have 16 and nanoseconds 19. The calculator detects this automatically.

What date is the timestamp 1781624168859?

It has 13 digits, so it is milliseconds: 2026-06-16 15:36:08.859 UTC. As a JWT exp it must be divided by 1000 to 1781624168.

What happens if a JWT exp is in milliseconds?

Libraries read it as seconds, which puts the expiry tens of thousands of years in the future — the token effectively never expires. Always divide Date.now() or currentTimeMillis() by 1000 (Math.floor(Date.now() / 1000)) before writing exp, iat or nbf.

How do I check if a JWT is expired in JavaScript?

Decode the payload (base64url) and compare: Date.now() >= payload.exp * 1000 means expired. For real authorization verify the signature with a library — jsonwebtoken’s jwt.verify or jose’s jwtVerify — which also checks exp and nbf with an optional clockTolerance.

How do I get the JWT expiration date in C#?

With System.IdentityModel.Tokens.Jwt, new JwtSecurityTokenHandler().ReadJwtToken(token).ValidTo returns the UTC expiry, and DateTimeOffset.FromUnixTimeSeconds(exp) converts a raw exp. Validation adds TokenValidationParameters.ClockSkew, which defaults to 5 minutes — set TimeSpan.Zero for exact expiry.

What is the nbf claim?

nbf (not before) is the earliest time the token may be used, also in Unix seconds. A token is valid only when nbf ≤ now < exp, give or take the leeway. Most tokens set nbf equal to iat or omit it.

What is a 30-day refresh token expiration in seconds?

2,592,000 seconds (2,592,000,000 ms). Amazon Cognito’s refresh tokens default to 30 days, and 30 days is also the maximum Auth0 allows for API access tokens.

What does jose setExpirationTime(number) do?

It treats a number as the absolute exp timestamp, not a lifetime. setExpirationTime(3600) would make the token expire in 1970. Pass a string such as "1h" or "15 minutes" for a lifetime relative to now, or a Date.

Is it safe to decode a JWT in this calculator?

The token is decoded entirely in your browser; nothing is uploaded. Decoding is not verification — anyone can read a JWT payload, so never put secrets in it, and avoid pasting live production tokens into any site you do not trust.

What is the year 2038 problem for JWT?

The largest signed 32-bit integer, 2,147,483,647, is 2038-01-19 03:14:07 UTC. Systems that store exp in a 32-bit int will overflow after that. Long-lived tokens or certificates that expire after 2038 need 64-bit storage.

How does this JWT expiry calculator work?

It base64url-decodes the header and payload locally, reads exp, iat, nbf and auth_time, converts them to UTC and your local time, and compares them with your device clock plus the leeway you choose. The converter tabs auto-detect seconds vs milliseconds and parse expiresIn numbers, "15m"-style strings, ISO 8601 and .NET TimeSpan values.

theCalcs

Get Custom Solution

Loading calculators...

Fetching calculator categories and tools for this section.

Go to Calculators Browse Calculators

Loading the page...

Preparing tools and content for you. This usually takes a second.

Go Home Browse Calculators

theCalcs

Get Custom Solution

RFC 7519 · decoded in your browser · updated October 2, 2026

JWT Expiry Time Calculator: Decode exp to a Date and Convert Token Lifetimes

Quick answer

A JWT’s exp claim is a Unix timestamp in seconds (not milliseconds), and exp = iat + lifetime. 15 minutes = 900, 1 hour = 3,600, 24 hours = 86,400, 7 days = 604,800 seconds. A config value of 86400000 is milliseconds = 24 hours. To read exp as a date use new Date(exp * 1000): exp 1790943300 is 2026-10-02 12:15:00 UTC. The token is expired when now ≥ exp (plus any clock-skew leeway).

Paste a token to see when it expires in UTC and your local time, with a live countdown. Convert any exp or iat value — 10-digit seconds or 13-digit milliseconds — and turn lifetimes like 900, “15m”, “7d” or 86400000 into exp plus ready-to-use code for jsonwebtoken, jose, PyJWT, Java, Spring, .NET, Go and PHP.

Decode exp, iat, nbf locally — nothing uploaded
Live valid / expired status with clock skew
Seconds vs milliseconds auto-detection
expiresIn and config-value converter for 9 libraries

Last updated October 2, 2026. Free, no sign-up. Guides: how to calculate JWT expiration · JWT clock skew

JWT Expiry Time Calculator

Decode a token’s exp, iat and nbf to dates, convert timestamps in seconds or milliseconds, and turn any lifetime into exp and library config.

Paste a JWT (with or without “Bearer ”)

Decoded in your browser — nothing is sent anywhere. The signature is not verified.

Clock skew leeway(seconds)

.NET 300 · Spring 60 · most libraries 0

Status right now

Checking clock…

—

exp (UTC)

2026-10-02 12:15:00 UTC

1790943300 · local —

Lifetime (exp − iat)

15m

900 seconds · age —

Claim	Raw value	UTC	Your time	Relative
Issued at (iat)	1790942400	2026-10-02 12:00:00 UTC	—	—
Not before (nbf)	1790942400	2026-10-02 12:00:00 UTC	—	—
Expires (exp)	1790943300	2026-10-02 12:15:00 UTC	—	—

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload (claims)

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1790942400,
  "nbf": 1790942400,
  "exp": 1790943300
}

JWT times are NumericDate values: seconds since 1970-01-01T00:00:00Z (RFC 7519). Status uses this device’s clock.

How JWT expiration time is calculated

A JWT expiry time is the exp claim in a JSON Web Token: the moment after which the token must be rejected. RFC 7519 defines exp, iat (issued at) and nbf (not before) as NumericDate values — the number of seconds since 1970-01-01T00:00:00 UTC, not milliseconds. The expiry is calculated as exp = iat + lifetime, so a 15-minute token issued at 1790942400 has exp 1790943300 (2026-10-02 12:15:00 UTC). To read it as a date, multiply by 1000 for a JavaScript Date or convert the seconds directly.

exp = iat + lifetime (seconds) · iat = floor(Date.now() / 1000)
date = new Date(exp × 1000) · expired ⇔ now ≥ exp + leeway · not yet valid ⇔ now < nbf − leeway

Example: a token issued at 1790942400 (2026-10-02 12:00:00 UTC) with a 15-minute lifetime gets exp 1790942400 + 900 = 1790943300 (2026-10-02 12:15:00 UTC). A verifier with 60 seconds of leeway still accepts it until 2026-10-02 12:16:00 UTC. If the issuer had written Date.now() + 900000 instead, exp would be a 13-digit millisecond value that libraries read as the year 58,000 — a token that never expires.

JWT token lifetimes in seconds and milliseconds

Use the seconds column for jsonwebtoken expiresIn numbers and for exp − iat; the milliseconds column for Java Date, Spring properties and JavaScript Date arithmetic.

Lifetime	Seconds	Milliseconds	ms / jose string	ISO 8601	Typical use
1 minute	60	60,000	"1m"	PT1M	One-time links, step-up auth
5 minutes	300	300,000	"5m"	PT5M	Keycloak and Spring Authorization Server default access token
10 minutes	600	600,000	"10m"	PT10M	Auth0 MFA token (fixed)
15 minutes	900	900,000	"15m"	PT15M	Common access-token lifetime
30 minutes	1,800	1,800,000	"30m"	PT30M	Access token, internal apps
1 hour	3,600	3,600,000	"1h"	PT1H	Firebase, Google, Cognito and Okta default
2 hours	7,200	7,200,000	"2h"	PT2H	Longer browser sessions
8 hours	28,800	28,800,000	"8h"	PT8H	Workday session limit
10 hours	36,000	36,000,000	"10h"	PT10H	Auth0 ID token default
12 hours	43,200	43,200,000	"12h"	PT12H	Shift-length sessions
24 hours	86,400	86,400,000	"1d"	P1D	Auth0 access token default
7 days	604,800	604,800,000	"7d"	P7D	Refresh token, remember-me
14 days	1,209,600	1,209,600,000	"14d"	P14D	Refresh token
30 days	2,592,000	2,592,000,000	"30d"	P30D	Cognito refresh token default; Auth0 access-token maximum
90 days	7,776,000	7,776,000,000	"90d"	P90D	Okta org refresh token
1 year	31,536,000	31,536,000,000	"365d"	P365D	Service tokens (prefer rotation)

What does this expiration value mean?

The same number means very different lifetimes depending on the unit. Plain numbers of whole minutes in milliseconds (like 86400000) are read as milliseconds; others as seconds.

Value	Read as	Lifetime	Seconds
300	seconds (auto-detected)	5m	300
3600	seconds (auto-detected)	1h	3,600
86400	seconds (auto-detected)	1d	86,400
86400000	milliseconds (auto-detected)	1d	86,400
604800000	milliseconds (auto-detected)	7d	604,800
"3600"	milliseconds (quoted string)	3.6s	3.6
15m	time span string (vercel/ms, jose)	15m	900
7d	time span string (vercel/ms, jose)	7d	604,800
PT15M	ISO 8601 duration (Java Duration, Spring, XML)	15m	900
00:30:00	.NET TimeSpan hh:mm:ss	30m	1,800
${jwt_expiration_ms:86400000}	milliseconds (from the name “jwt_expiration_ms”)	1d	86,400
1h30m	compound time span	1h 30m	5,400

exp from iat: worked examples

iat = 1790942400 (2026-10-02 12:00:00 UTC).

Lifetime	Seconds added	exp	Expires (UTC)
5m	300	1790942700	2026-10-02 12:05:00 UTC
15m	900	1790943300	2026-10-02 12:15:00 UTC
1h	3,600	1790946000	2026-10-02 13:00:00 UTC
1d	86,400	1791028800	2026-10-03 12:00:00 UTC
7d	604,800	1791547200	2026-10-09 12:00:00 UTC
30d	2,592,000	1793534400	2026-11-01 12:00:00 UTC

Timestamp to date: seconds vs milliseconds

10 digits are seconds, 13 are milliseconds. exp must be the seconds value.

Value	Detected	UTC date	exp (seconds)
1516239022	10 digits → seconds	2018-01-18 01:30:22 UTC	1516239022
1700000000	10 digits → seconds	2023-11-14 22:13:20 UTC	1700000000
1790942400	10 digits → seconds	2026-10-02 12:00:00 UTC	1790942400
1781624168859	13 digits → milliseconds	2026-06-16 15:36:08.859 UTC	1781624168
2000000000	10 digits → seconds	2033-05-18 03:33:20 UTC	2000000000
2147483647	10 digits → seconds	2038-01-19 03:14:07 UTC	2147483647

Default token expiration by identity provider

Provider	Token	Default lifetime	Seconds	Configurable
Auth0	Access token (custom API)	24 hours	86,400	Up to 30 days (2,592,000 s)
Auth0	ID token	10 hours	36,000	Per application
Amazon Cognito	Access and ID token	1 hour	3,600	5 minutes to 1 day
Amazon Cognito	Refresh token	30 days	2,592,000	60 minutes to 10 years
Microsoft Entra ID	Access token	60–90 minutes (random, ~75 avg)	3,600–5,400	Token lifetime policy
Google	OAuth access token / ID token	1 hour	3,600	No (user tokens)
Firebase Auth	ID token	1 hour	3,600	No
Okta (org server)	Access and ID token	1 hour	3,600	Custom server: 5 minutes to 24 hours
Okta (org server)	Refresh token	90 days	7,776,000	Custom server: 10 minutes to unlimited
Keycloak	Access token	5 minutes	300	Realm or client setting
Spring Authorization Server	Access / refresh token	5 minutes / 60 minutes	300	TokenSettings

The JWT standard itself has no default lifetime, and most libraries add no exp unless you set one. OAuth responses report the access-token lifetime in seconds as expires_in.

JWT clock skew defaults by library

Library	Setting	Unit	Default
jsonwebtoken (Node)	clockTolerance	seconds	0 (none)
jose (Node, browsers)	clockTolerance	seconds or "30s"	0 (none)
PyJWT (Python)	leeway	seconds or timedelta	0 (none)
jjwt (Java)	clockSkewSeconds()	seconds	0 (none)
Spring Security resource server	JwtTimestampValidator(clockSkew)	Duration	60 s (1m)
Microsoft.IdentityModel (.NET)	TokenValidationParameters.ClockSkew	TimeSpan	300 s (5m)
golang-jwt v5 (Go)	jwt.WithLeeway()	time.Duration	0 (none)
firebase/php-jwt (PHP)	JWT::$leeway	seconds	0 (none)

Set a 15-minute expiry in each library

Library	Code	Watch out
Node — jsonwebtoken	jwt.sign(payload, secret, { expiresIn: 900 }) // or '15m'	Number = seconds. A string with no unit is milliseconds: "60" = 60 ms.
Node — jose	new SignJWT(payload).setIssuedAt().setExpirationTime('15m')	String = time from now. A number is an absolute exp timestamp, not a lifetime.
Python — PyJWT	{"exp": datetime.now(tz=timezone.utc) + timedelta(seconds=900)}	PyJWT converts the datetime to Unix seconds. An int must already be seconds.
Java — jjwt	.expiration(new Date(System.currentTimeMillis() + 900000L))	Java Date uses milliseconds; jjwt writes exp in seconds.
Spring property	jwt.expiration=900000 # ms, if your code does new Date(now + expiration)	Custom property: the unit is whatever your code assumes. Java Duration style: PT…
Spring Authorization Server	TokenSettings.builder().accessTokenTimeToLive(Duration.ofSeconds(900))	Default access token: 5 minutes.
.NET	Expires = DateTime.UtcNow.AddSeconds(900) // TimeSpan 00:15:00	Validation adds ClockSkew (default 5 minutes).
Go — golang-jwt v5	"exp": jwt.NewNumericDate(time.Now().Add(900 * time.Second))	NumericDate serializes to Unix seconds.
PHP — firebase/php-jwt	'exp' => time() + 900	time() returns seconds.

Keep access tokens short

Use minutes, not days, for access tokens and refresh them with a revocable refresh token. You cannot shorten a signed token after issuing it.

Write seconds, not milliseconds

Math.floor(Date.now() / 1000) for iat. A 13-digit exp means the token never expires in most libraries.

Sync clocks, add small leeway

Run NTP on every server and allow 30–60 seconds of leeway. .NET already allows 5 minutes unless you change ClockSkew.

Sources and how this calculator was checked

Claim definitions come from RFC 7519; units and defaults from each library’s documentation and source code; provider lifetimes from official documentation. Every table on this page is generated by the same code as the calculator. Tokens are decoded only in your browser and signatures are not verified — use your JWT library to validate tokens before trusting them.

RFC 7519 — JSON Web Token (JWT), IETFNumericDate = seconds since 1970-01-01T00:00:00Z UTC; exp, nbf and iat definitions; leeway “usually no more than a few minutes”.
OWASP — JSON Web Token Cheat SheetToken reuse is mitigated with a short expiration time; validate exp, iss and aud, and plan for revocation.
auth0/node-jsonwebtoken — READMEexpiresIn: number = seconds; a string without units is milliseconds ("120" = 120 ms); clockTolerance in seconds.
panva/jose — SignJWT.setExpirationTimeA number is used directly as exp; a string is a time span from now; clockTolerance in seconds or a string.
PyJWT — API referenceleeway is seconds or a timedelta; exp accepts a UTC datetime or Unix seconds.
Microsoft — TokenValidationParameters.DefaultClockSkewDefault clock skew 300 seconds (5 minutes).
Spring Security — OAuth 2.0 Resource Server JWTResource Server configures a default clock skew of 60 seconds (JwtTimestampValidator).
Spring Authorization Server — TokenSettingsAccess token time-to-live default 5 minutes; refresh token 60 minutes.
Auth0 — Update access token lifetimeDefault 86,400 seconds (24 hours), maximum 2,592,000 seconds (30 days).
Auth0 — ID tokensID token valid for 36,000 seconds (10 hours) by default.
Amazon Cognito — TokenValidityUnitsTypeAccess and ID tokens 5 minutes to 1 day (default 1 hour); refresh tokens 60 minutes to 10 years (default 30 days).
Microsoft identity platform — Access tokensDefault access-token lifetime is a random 60–90 minutes (75 on average).
Google Cloud — Token typesUser access tokens and ID tokens last 1 hour.
Firebase — Manage user sessionsFirebase ID tokens are short-lived, lasting one hour.
Okta — Lifetime of Okta-minted JWTsOrg server: access and ID tokens 60 minutes, refresh 90 days; custom servers 5 minutes to 24 hours.
Keycloak — Session and token timeoutsAccess Token Lifespan setting (default 5 minutes).

Need to inspect the raw segments? Use the Base64 decoder. Building developer tools or an internal auth dashboard? We build branded calculators for your product.

Get Custom Calculator for Your Business

Frequently Asked Questions

Share This Calculator

Help others discover this useful tool

Copy Link

Share on Social Media

X Facebook LinkedIn WhatsApp

Share via Email

Suggested hashtags: #JWT #WebDev #API #Security #OAuth

Related Calculators

Base64 Encode / Decode

Decode JWT segments and other base64 data.