JWT vs refresh token: what is the difference?
Try code in the playgroundUnderstand the concept
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
Important ideas
-
An access token allows API access for a limited time.
-
A refresh token gets new access tokens; protect it and support revocation or rotation.
-
Validate signature, allowed algorithm, expiry, issuer and audience; signed JWT contents are readable.
-
Refresh-token rotation needs server-side tracking or provider support to detect reuse and revoke an affected session.
Can you explain it without the notes?
JWT vs refresh token: what is the difference?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
Turn this concept into a clear answer.
- A signed JWT is usually readable, not encrypted, and checking its signature alone does not prove it was issued for your API.
Adapted from 02_NODE_EXPRESS_HTTP.md · “JWT vs refresh token: what is the difference?”. Examples are study fragments; framework behavior can depend on your version.