diff --git a/lib/src/jwt.dart b/lib/src/jwt.dart
index 1fa73cc..3761e71 100644
--- a/lib/src/jwt.dart
+++ b/lib/src/jwt.dart
@@ -210,7 +210,8 @@ class JWT {
   static JWT decode(String token) {
     try {
       final parts = token.split('.');
-      final header = jsonBase64.decode(base64Padded(parts[0]));
+      var header =
+          jsonBase64.decode(base64Padded(parts[0])) as Map<String, dynamic>;
 
       final payload =
           (jsonBase64.decode(base64Padded(parts[1])) as Map<String, dynamic>);
@@ -222,8 +223,8 @@ class JWT {
 
       return JWT(
         payload,
-        header: header is! Map<String, dynamic> ? null : header,
-        audience: audience,
+        header: header,
+        audience: audiance,
         issuer: issuer,
         subject: subject,
         jwtId: jwtId,
diff --git a/test/header_test.dart b/test/header_test.dart
index b9d40f4..2e8d8a2 100644
--- a/test/header_test.dart
+++ b/test/header_test.dart
@@ -147,5 +147,18 @@ void main() {
         });
       });
     });
+
+    group('invalid header', () {
+      test('invalid (non map) header should fail to decode', () {
+        final token =
+            'W10' + // base64 for `[]`, which can JSON decode but is not valid
+                '.eyJmb28iOiJiYXIifQ' +
+                '.'; // signature is not checked here
+
+        final jwt = JWT.tryDecode(token);
+
+        expect(jwt, isNull);
+      });
+    });
   });
 }