exp
What this is
RFC 7519 registers exp as a NumericDate: seconds since 1970-01-01T00:00Z. Verifiers must reject the JWT when the current time is on or after exp. Many libraries add a small clock-skew leeway (30–120s). exp is optional in the spec and mandatory in almost every real API.
FAQ
- Is exp milliseconds?
- No. JWT NumericDate is seconds. A 13-digit exp is a bug — usually someone stuffed Date.now() in by accident.
- Should I trust exp without a signature?
- No. Anyone can mint a payload with exp in 2099. Check the signature against the issuer key first, then exp.