How to Decode JWT Tokens in 5 Different Programming Languages

Published: 05/06/2025 By: JWT Decode Team Category: Development

JSON Web Tokens (JWT) have become the standard for authentication in modern applications. Whether you're working with JavaScript, Python, Java, C#, or Flutter, understanding how to decode JWT tokens is essential for implementing secure authentication. This comprehensive guide will show you how to decode JWT tokens in five popular programming languages, with practical code examples and best practices.

Understanding JWT Structure
JWT Decode in JavaScript
JWT Decode in Python
JWT Decode in Java
JWT Decode in C#
JWT Decode in Flutter
Best Practices and Security Considerations
Common Issues and Troubleshooting

Understanding JWT Structure

Before diving into language-specific implementations, let's understand the basic structure of a JWT token. A JWT consists of three parts separated by dots (.):

PAYLOAD

{"sub": "1234567890", "name": "John Doe"}

SIGNATURE

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

JWT Decode in JavaScript

JavaScript offers several ways to decode JWT tokens. The most popular approach is using the jwt-decode npm package:

// Using npm package
import jwtDecode from 'jwt-decode';

// Decode token
const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';
const decoded = jwtDecode(token);

// Access payload data
console.log(decoded.sub);  // User ID
console.log(decoded.name); // User name

For React applications, you can use the same package:

// In React component
import { useEffect, useState } from 'react';
import jwtDecode from 'jwt-decode';

function UserProfile() {
    const [userData, setUserData] = useState(null);

    useEffect(() => {
        const token = localStorage.getItem('token');
        if (token) {
            const decoded = jwtDecode(token);
            setUserData(decoded);
        }
    }, []);

    return (
        // Component JSX
    );
}

JWT Decode in Python

Python developers can use the PyJWT library to decode JWT tokens:

import jwt

# Decode token without verification
token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
decoded = jwt.decode(token, options={"verify_signature": False})

# Decode and verify token
secret = 'your-secret-key'
decoded = jwt.decode(token, secret, algorithms=["HS256"])

# Access payload data
print(decoded['sub'])  # User ID
print(decoded['name']) # User name

For Flask applications, you can integrate JWT decoding with your authentication system:

from flask import request, jsonify
import jwt

@app.route('/api/protected')
def protected_route():
    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'error': 'Token missing'}), 401
    
    try:
        decoded = jwt.decode(token, app.config['SECRET_KEY'], algorithms=["HS256"])
        return jsonify({'user': decoded})
    except jwt.InvalidTokenError:
        return jsonify({'error': 'Invalid token'}), 401

JWT Decode in Java

Java developers can use the jjwt library to decode JWT tokens:

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

// Decode token
String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
String secret = "your-secret-key";

Claims claims = Jwts.parserBuilder()
    .setSigningKey(secret.getBytes())
    .build()
    .parseClaimsJws(token)
    .getBody();

// Access payload data
String userId = claims.getSubject();
String name = claims.get("name", String.class);

For Spring Boot applications, you can use the built-in JWT support:

@RestController
@RequestMapping("/api")
public class JwtController {
    
    @GetMapping("/user")
    public ResponseEntity getUserInfo(@RequestHeader("Authorization") String token) {
        try {
            Claims claims = Jwts.parserBuilder()
                .setSigningKey(secretKey.getBytes())
                .build()
                .parseClaimsJws(token)
                .getBody();
            
            return ResponseEntity.ok(claims);
        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }
    }
}

JWT Decode in C#

C# developers can use the System.IdentityModel.Tokens.Jwt package to decode JWT tokens:

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;

// Decode token
string token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
var handler = new JwtSecurityTokenHandler();
var jsonToken = handler.ReadToken(token) as JwtSecurityToken;

// Access payload data
string userId = jsonToken.Claims.First(claim => claim.Type == "sub").Value;
string name = jsonToken.Claims.First(claim => claim.Type == "name").Value;

For ASP.NET Core applications, you can use the built-in JWT authentication:

[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
    [HttpGet("user")]
    public IActionResult GetUserInfo()
    {
        var token = Request.Headers["Authorization"].ToString().Replace("Bearer ", "");
        var handler = new JwtSecurityTokenHandler();
        var jsonToken = handler.ReadToken(token) as JwtSecurityToken;
        
        return Ok(new {
            UserId = jsonToken.Claims.First(c => c.Type == "sub").Value,
            Name = jsonToken.Claims.First(c => c.Type == "name").Value
        });
    }
}

JWT Decode in Flutter

Flutter developers can use the jwt_decoder package to decode JWT tokens:

import 'package:jwt_decoder/jwt_decoder.dart';

// Decode token
String token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';
Map decodedToken = JwtDecoder.decode(token);

// Access payload data
String userId = decodedToken['sub'];
String name = decodedToken['name'];

// Check if token is expired
bool isExpired = JwtDecoder.isExpired(token);

For Flutter applications with state management:

class AuthService {
  Future getUserFromToken(String token) async {
    try {
      Map decodedToken = JwtDecoder.decode(token);
      
      return UserModel(
        id: decodedToken['sub'],
        name: decodedToken['name'],
        email: decodedToken['email'],
      );
    } catch (e) {
      throw Exception('Invalid token');
    }
  }
}

Best Practices and Security Considerations

Always verify token signatures when decoding in production environments
Check token expiration before processing
Validate token claims against your application's requirements
Use secure storage methods for tokens (e.g., HttpOnly cookies, secure storage)
Implement proper error handling for invalid tokens
Keep your JWT libraries updated to the latest versions
Use appropriate token expiration times
Implement token refresh mechanisms for long-lived sessions

Common Issues and Troubleshooting

1. Invalid Token Format

Ensure your token follows the correct JWT format (header.payload.signature). Common issues include:

Missing or extra dots in the token
Invalid base64url encoding
Malformed JSON in header or payload

2. Signature Verification Failures

Common causes of signature verification failures:

Incorrect secret key
Mismatched algorithm in token header
Token tampering

3. Token Expiration

Handle token expiration gracefully:

Implement proper error handling for expired tokens
Use refresh tokens for seamless user experience
Set appropriate expiration times based on your security requirements

Table of Contents