How to Read JWT Expiration and Security Claims Like a Developer

Your API starts returning 401 Unauthorized at exactly 10:00 AM every day. The tokens worked an hour ago. You check the server logs. Nothing obvious. You open the token in a JWT decoder and look at the payload. There it is: "exp": 1723507200. The token expired at 10:00 AM. The exp claim — a Unix timestamp — is the expiration time, and your token died on schedule.

How to Read a JWT Expiration Claim

Step 1: Decode the token. Paste your JWT into the JWT decoder. A JWT is three base64url parts separated by dots: header, payload, signature. The decoder splits them and shows the claims in plain text. Step 2: Find the exp claim. Look for exp in the payload. It is a Unix timestamp — seconds since January 1, 1970, UTC. The decoder converts it to a human-readable date. If the date is in the past, the token is expired. Step 3: Check the other security claims. iss tells you the issuer — the server that issued the token. aud is the audience — the service the token is meant for. iat is issued-at time. nbf (not before) means the token is not valid until a certain time. A token that fails aud will be rejected even if it has not expired. Step 4: Verify the signature. The signature proves the token was not tampered with. The hash generator shows you how signature algorithms produce fixed-length outputs. The base64 converter helps you understand the encoding layer under the claims. The JWT decoder is the diagnostic tool. The exp claim is the expiry clock. Together they turn a confusing 401 into a fixable cause.