How to decode JWTs in Python

Install PyJWT: pip install PyJWT. To decode and verify: import jwt; payload = jwt.decode(token, secret, algorithms=['HS256']). To decode without verification (inspection only): payload = jwt.decode(token, options={'verify_signature': False}). For RS256 tokens: payload = jwt.decode(token, public_key, algorithms=['RS256']). Always specify the algorithms parameter explicitly to prevent algorithm confusion attacks. Note: the package is 'PyJWT' on pip but imported as 'jwt' — don't confuse with the deprecated 'jwt' package.

# Python — decode and verify JWT tokens
import jwt  # pip install PyJWT

# Decode WITHOUT verification (inspect only)
payload = jwt.decode(token, options={"verify_signature": False})
print(payload)  # {"sub": "user-1", "exp": 1711234567}

# Verify with secret (recommended)
try:
    payload = jwt.decode(token, "your-secret-key", algorithms=["HS256"])
    print("Valid:", payload["sub"])
except jwt.ExpiredSignatureError:
    print("Token expired")
except jwt.InvalidTokenError as e:
    print(f"Invalid token: {e}")

Python JWT in Flask and Django

Flask-JWT-Extended simplifies JWT auth: from flask_jwt_extended import jwt_required, get_jwt_identity; @app.route('/protected'); @jwt_required(); def protected(): user = get_jwt_identity(). For Django REST Framework: pip install djangorestframework-simplejwt, then add 'rest_framework_simplejwt.authentication.JWTAuthentication' to DEFAULT_AUTHENTICATION_CLASSES. Both libraries handle token creation, refresh, blacklisting, and claim validation automatically. For FastAPI: pip install python-jose; use OAuth2PasswordBearer + jwt.decode() in a Depends() dependency.

Common Python JWT pitfalls

Pitfall 1: importing 'jwt' when you have both PyJWT and python-jose installed — they conflict. Pitfall 2: not specifying algorithms= allows algorithm switching attacks. Pitfall 3: jwt.decode() in PyJWT 2.x requires algorithms parameter (breaking change from 1.x). Pitfall 4: DecodeError vs ExpiredSignatureError vs InvalidSignatureError — handle each differently. Use this tool to inspect your token's algorithm (alg header) and expiration (exp claim) before writing Python decode logic.