Security & Certificates
JWT Claims Explained: exp, iat and nbf
The exp, nbf and iat claims are NumericDate values: numbers measured in seconds from the Unix epoch. They describe different points in a token's lifetime.
Published
NumericDate means seconds since the Unix epoch
JWT time claims use a JSON number representing seconds from 1970-01-01T00:00:00Z, ignoring leap seconds. Passing the same number to a JavaScript Date constructor requires multiplying by 1000.
const expiresAt = new Date(payload.exp * 1000);exp: expiration time
The token must not be accepted on or after exp. A decoder can compare the number with the current clock, but the application still needs a verified token and a clear policy for missing or invalid expiration data.
if (nowSeconds >= payload.exp) reject("expired");nbf: not valid before this time
The token must not be accepted before nbf. This supports delayed activation, scheduled access and other workflows where issuance happens before use is allowed.
if (nowSeconds < payload.nbf) reject("not active yet");iat: issued-at time, not an expiration rule
iat records when the token was issued and can help calculate age or detect an obviously future timestamp. It does not say when the token expires and does not replace exp.
const tokenAgeSeconds = nowSeconds - payload.iat;exp, iat and nbf side by side
| Claim | Meaning | Typical rejection check |
|---|---|---|
| exp | Expiration time | now >= exp |
| nbf | Not valid before | now < nbf |
| iat | Issued at | Policy-specific age or future-time check |
Clock skew needs a small, explicit leeway
The JWT specification allows a small leeway for clock differences. Keep it bounded and documented; a large tolerance silently extends the time in which expired or premature tokens may be accepted.
Validation checklist for time claims
- Verify the signature before trusting any time claim.
- Use seconds consistently and compare against a reliable clock.
- Reject malformed or non-numeric values according to application policy.
- Apply one documented clock-skew allowance.
- Also validate issuer, audience and any required application claims.
Try the example
Inspect exp, iat and nbf as NumericDate values
The payload contains all three registered time claims so their raw seconds and formatted dates can be compared.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3MDAwMDAwMDAsIm5iZiI6MTY5OTk5OTkwMCwiZXhwIjoyMTQ3NDgzNjQ3fQ.ZGVtby1zaWduYXR1cmUExpected result: The timestamps table identifies issued-at, not-before and expiration values and shows their UTC and local representations.
Read the timestamps
Inspect exp, iat and nbf as dates
Decode a synthetic token and compare each raw NumericDate with its UTC and local representation.