JWT Timestamp Decoder — exp / iat / nbf to Human Dates | tick.pro
Paste a JWT to decode its header and payload. exp, iat, and nbf become human dates with expired-in or valid-for phrasing, decoded in your browser.
The three time claims
exp — expires at. After this instant the token should be rejected.iat — issued at. When the token was created.nbf — not before. Before this instant the token must be rejected.This tool reads timestamps. It does not verify the signature — only the application holding the signing key can do that.
Frequently Asked Questions
Does pasting a token here send it anywhere?
No. In the browser the token is decoded entirely in JavaScript on the page; it never leaves your machine. The curl and JSON endpoints do decode server-side, so use the browser if a token is sensitive.
Does this verify the JWT signature?
No, and a web page that claimed to would be lying. Verifying requires the signing key. This tool reads the timestamps — exp, iat, nbf — and reports whether they say the token is expired, not yet valid, or active.
Which time claims are decoded?
exp (expires at), iat (issued at), and nbf (not before), the three NumericDate claims defined by RFC 7519. Each is shown as an epoch value, an ISO 8601 date, and a relative phrase such as "expired 2 days ago".
curl "https://tick.pro/jwt?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwibmFtZSI6ImRlbW8iLCJleHAiOjIwMDAwMDAwMDAsImlhdCI6MTc2MDAwMDAwMH0.W5K4jR6ZzVQqYB9mXoPvN8sT2wE3uI7yH0aS9dF1gH2"