TechCompare LogoTechCompare

How long should a JWT access token last? Lifetimes that work

Keep access tokens short, often 5 minutes to 1 hour, and use refresh tokens that the server can revoke for long sessions.

A JWT can't be taken back once it's issued, at least not without extra server state. Whoever holds it can use it until exp. That makes the lifetime your main control over how much harm a leaked token can do. Most systems settle on access tokens that last minutes to an hour, paired with a refresh token that gets new ones.

By TechCompare · Updated

Topic
Token lifetime
Expiration policy
Category
Best Practices
Settings that keep tokens safe
Try the live JWT Decoder. Decode a token, read its time claims, and verify the signature in your browser.
Edit in the full tool

How this is calculated

Real providers show the range. Google and Firebase access and ID tokens last 1 hour. Amazon Cognito defaults to 1 hour and lets you pick anywhere from 5 minutes to 1 day. Microsoft Entra ID gives access tokens a random lifetime between 60 and 90 minutes, which spreads out refresh traffic. The trade off is simple. A short lifetime limits a stolen token to a short window and means role or permission changes take effect soon. It also means more refresh requests, and clients have to handle a token that expires mid request. A long lifetime cuts traffic but turns every leaked token into a long term key, and that's how tokens found in logs or browser storage turn into breaches. Refresh tokens solve the gap. They're long lived but only sent to the issuer, so the issuer can store, rotate and revoke them. Rotating the refresh token on every use, and rejecting an old one if it shows up again, also catches theft. For high risk actions like changing a password, check the token's iat or the session's auth_time and ask the user to sign in again if it's too old.

Verdict

Start with 15 minutes access tokens and rotating refresh tokens, then adjust. Go shorter for admin tools and money movement. Go longer only for low risk reads where refresh traffic is a real cost, and never issue access tokens without exp.

More JWT scenarios

Decode vs verify
Anyone can read a JWT. Only a signature check with the right key tells you who wrote it.
View details ➜
exp, nbf and iat
The three time claims, what each one means, and how verifiers compare them with the clock.
View details ➜
Fixing jwt expired
Why fresh tokens fail with "jwt expired" and how clock drift, leeway and milliseconds cause it.
View details ➜

Related guides

Two factor vs strong password
Sign in protection before a token is ever issued.
View guide ➜

Frequently asked questions

Is a 24 hour JWT too long?
For an access token sent with every API call, usually yes. A token that leaks in a log or a browser extension stays useful for a full day. Use a short access token and a refresh token instead.
Can I revoke a JWT before it expires?
Not by itself. You need server state, like a deny list of jti values, a per user token version, or short lifetimes so revocation happens through refresh. Each adds a lookup, which is the trade for instant logout.
Should ID tokens and access tokens have the same lifetime?
They can, but they do different jobs. The ID token tells the client who signed in, and the access token goes to APIs. Keep the access token short, since it's the one that grants access.

Related tools

Text Encoding Converter

Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.

Use tool ➜

Unix Timestamp

Convert between Unix timestamps and human-readable dates.

Use tool ➜

JSON Formatter

Validate, format, and minify JSON. Browse it as a tree, run JSONPath queries, compare two documents, or validate against a JSON Schema.

Use tool ➜