JWT NumericDate counts seconds from the Unix epoch. exp marks a time at or after which a verifier must reject under its policy; nbf marks a time before which it must reject; iat records issuance. Their presence and decoded values still require a verified signature and application rules.
Preserve the original value
JWTLens shows the raw JSON representation beside UTC and converts only exact whole-second integers within the supported date range. Fractions, strings and out-of-range integers remain visible but receive no UTC conversion.
The verifier owns the clock
A browser clock may be wrong and cannot know server tolerance, replay policy or session revocation. JWTLens therefore makes no expired, active or not-yet-valid label. The receiving service must compare a verified claim with its controlled clock.
Verification checklist
After inspecting structure, verify the compact token with a maintained JOSE library in the service that receives it. Pin the allowed algorithm; select the trusted key by reviewed policy; validate the signature before trusting claims; then enforce issuer, audience, subject, expiry, not-before, clock tolerance and application-specific requirements. Reject unexpected critical headers and duplicate data before authorization. JWTLens deliberately performs none of these trust decisions.