Can an Expired JWT Token Still Be Verified?
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
Detailed Technical Explanation
A JWT signature is a mathematical proof calculated as `HMAC(Header + "." + Payload, Secret)` or through asymmetric public-key cryptography. Because time does not alter the bytes in the token string, the signature verification algorithm will always evaluate to `true` even decades later. However, RFC 7519 defines the `exp` (Expiration Time) claim as mandatory to enforce. Standard JWT verification libraries perform two distinct steps: (1) verify the cryptographic signature, and (2) verify that `currentTime < exp`. If the timestamp has passed, the library throws a `TokenExpiredError`.
Technical Example & Code
Node.js jsonwebtoken demonstrates that signature checking succeeds even when the token is rejected for expiration.
import jwt from 'jsonwebtoken';
const token = "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MDAwMDAwMDB9.signature";
const secret = "secret_key";
try {
// Standard verification checks both signature AND expiration:
jwt.verify(token, secret);
} catch (err) {
console.log(err.name); // "TokenExpiredError"
// Note: The signature was valid, but current time exceeded 'exp'!
}
// Bypassing expiration check explicitly (only checks math signature):
const payload = jwt.verify(token, secret, { ignoreExpiration: true });
console.log('Signature is mathematically authentic:', payload);Why This Is the Case (Underlying Architectural Rationale)
"Cryptographic hash functions and digital signatures are purely deterministic functions of input bit sequences; they possess no temporal awareness. Expiration is a semantic application-layer policy enforced by parsing the numeric Unix epoch timestamp stored inside the payload and comparing it against the system wall clock."
Common Misconception vs Reality
"When a JWT expires, its cryptographic signature automatically breaks or degrades."
The cryptographic signature never degrades over time; expiration is strictly an application logic validation comparing the `exp` claim against current epoch seconds.
Related Curious-Techie Resources
Interactive JWT Engineering Lab →
Hands-on sandbox for tampering with claims, inspecting Base64URL encoding, and testing expired tokens.
Interactive ToolJWT Decoder Tool →
Inspect expiration timestamps, calculate remaining token lifespan, and check signature parameters.
Developer ReferenceJWT Claims Reference & Specifications →
Related Questions in the Q&A Knowledge Base
Yes, standard JSON Web Tokens (JWS) are signed, not encrypted. The header and payload are merely Base64URL-encoded strings that anyone can decode and read in plaintext without knowing the secret key.
You should not store authentication JWTs in localStorage because any Cross-Site Scripting (XSS) vulnerability on your page allows malicious JavaScript to instantly read and exfiltrate the token. Storing tokens in HttpOnly, Secure, SameSite cookies protects them from JavaScript access.
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
関連技術エコシステムと次の学習ステップ
関連技術解説記事
What Is a JSON Web Token (JWT)?
Direct definition and architectural breakdown of stateless token exchange.
JWT vs Session-Based Authentication: Architecture & Performance
Compare database session lookups with stateless JWT verification across scalability and revocation.
Troubleshooting: JWT Works in Postman but Fails in Browser
Diagnose and remediate CORS header stripping, HttpOnly cookie constraints, and preflight authorization failures.
実践ハンズオン診断ラボ
開発者向け規格・仕様リファレンス
次のステップへ進む
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.