JWT exp values are usually Unix timestamps in seconds. Decode and convert them before debugging auth code.
Payload example
{
"sub": "123",
"iss": "https://auth.example.com",
"aud": "api",
"iat": 1715947200,
"exp": 1893456000
}
How to use this example
- Decode the JWT header and payload.
- Convert exp, iat and nbf to UTC.
- Verify signature and expected claims on the server.
Notes
- Decoded payload is not proof of trust.
- Do not use JavaScript milliseconds where JWT expects seconds.
Related tools and fixes
Last updated: May 18, 2026