JWT Decoding·6 min read·2026-03-02T11:00:00Z

Understanding JWT Expiration: Clock Skew, Leeway, and Refresh Token Strategy

Token expiration (`exp`) is a stateless authentication system's primary defense against stolen credentials. Because you cannot easily revoke a stateless JWT before it expires, access token lifetimes must be kept short (e.g. 15 minutes) and paired with secure refresh tokens.

Handling Clock Drift with ClockTolerance / Leeway

Different servers can experience microsecond to minute-level clock drift. If an issuing server's clock is 5 seconds ahead of a verifying server, a newly issued token might be rejected as "not yet valid" (nbf failure). Most JWT verification libraries provide a `clockTolerance` (leeway) setting of 30 to 60 seconds to absorb NTP drift gracefully.

Frequently Asked Questions

What is the recommended lifespan for an access token?

Between 5 minutes and 30 minutes for web apps. Stored in memory or an HttpOnly cookie, backed by a refresh token stored securely on the database.

Understanding JWT Expiration – Clock Skew, Leeway & Refresh Tokens | Generador de Clave Secreta JWT | JWT Secret Key Generator