JWT Expiration

Free JWT Expiration calculator with clear step-by-step results.

About JWT Expiration

Short access tokens limit the damage of a leaked credential but generate refresh traffic in direct proportion, and clock skew tolerance extends the window in which a revoked token is still accepted. This turns a token policy into the two operational numbers it implies: refresh load and real validity window.

Formulas

Refresh load

Requests per second = sessions x (1440 / access lifetime minutes) / 86,400

Effective window

Seconds = access lifetime + allowed clock skew

Worked example

With the default values below, JWT Expiration returns Token refresh requests per second of 8.889. Change any input above and every figure here is recalculated in your browser.

Inputs used

Access token lifetimeaccepts 0.5–1,440 min: 15 min
Refresh token lifetimeaccepts 0.1–365 days: 30 days
Allowed clock skewaccepts 0–900 s: 60 s
Concurrent active sessionsminimum 0: 8,000

Results

Token refresh requests per second: 8.889 rps
Effective validity window with skew: 960 s
Refreshes per session per day: 96.0
Refresh lifetime as a multiple of access lifetime: 2,880 x

Step by step

1Values used
2Refresh load
3Effective window
4Token refresh requests per second= 8.889 rps
5Effective validity window with skew= 960 s
6Refreshes per session per day= 96.0
7Refresh lifetime as a multiple of access lifetime= 2,880 x

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How short should an access token be?

Five to fifteen minutes is the common range. Shorter limits exposure after a leak, but pushes refresh traffic and latency up, and stateless tokens cannot be revoked before they expire.

Why does clock skew matter?

Verifiers allow a tolerance so that slightly wrong client clocks do not reject valid tokens. That same tolerance means a token stays accepted past its nominal expiry, which matters when you are relying on expiry for revocation.