JWT vs refresh token: what is the difference?
Practice this questionWANT TO UNDERSTAND THE CONCEPT FIRST?Learn JWT vs refresh token: what is the difference?
Definition:
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
Key points:
-
An access token allows API access for a limited time.
-
A refresh token gets new access tokens; protect it and support revocation or rotation.
-
Validate signature, allowed algorithm, expiry, issuer and audience; signed JWT contents are readable.
-
Refresh-token rotation needs server-side tracking or provider support to detect reuse and revoke an affected session.
Interview point:
- A signed JWT is usually readable, not encrypted, and checking its signature alone does not prove it was issued for your API.
Adapted from 02_NODE_EXPRESS_HTTP.md · “JWT vs refresh token: what is the difference?”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.