JWT Expiration Debugging Guide
Debug JWT exp, iat and nbf claims, clock skew, refresh-token behavior and safe token inspection practices. This Formalint reference is written for working developers, DBAs and support engineers who need a repeatable debugging path instead of a one-line snippet with no context.
Use the notes below as a practical review order: understand the input, capture evidence, make one small change and verify the result before moving to the next assumption.
When to use this page
Understand token time claims without exposing real credentials. It is most useful when a small validation or debugging mistake can create noisy tickets, misleading logs or hard-to-review production changes.
Practical workflow
| Step | What to confirm |
|---|---|
| Decode only safe samples | Use redacted or development tokens when inspecting claims. |
| Convert timestamps | Translate exp, iat and nbf into the same timezone as your logs. |
| Check refresh behavior | An access token expiring normally should trigger a documented refresh flow. |
Claims to inspect
{
"iat": 1798790400,
"nbf": 1798790400,
"exp": 1798794000,
"iss": "https://auth.example.com",
"aud": "formalint-api"
}Review checklist
- Compare browser time, server time and identity-provider time.
- Check whether nbf is in the future.
- Verify issuer and audience before blaming expiration.
- Look for cached expired tokens in local storage, cookies or memory.
- Never log complete production JWTs.
Common mistake
JWT expiration bugs often look random because one server has clock skew or a frontend keeps using an old token after refresh fails.
Formalint is strongest when the page helps the developer decide what the tool cannot prove. Treat every formatter, regex and command as one layer of evidence, not the whole truth.
Frequently asked questions
What does exp mean?
It is the timestamp after which the token should not be accepted.
Can I extend exp on the client?
No. Token lifetime is signed by the issuer and must be changed in the identity system.
Related Formalint references
Continue with JWT Decoder, Timestamp Converter, OAuth JWT Debugging Checklist.