AG
JWT
DECODER
Decoder
Algorithms
Claims
Guides
About
한국어
English
日本語
中文
Español
Português
Français
Deutsch
Русский
العربية
Bahasa Indonesia
Decoder
/
Guides
/
Access tokens and refresh tokens
Guide
Access tokens and refresh tokens
The role of the short-lived access token and the refresh token that renews it.
Access token: a short-lived JWT (minutes) used to call APIs; if stolen it expires soon, limiting the damage.
Refresh token: a longer-lived token used to obtain a new access token when it expires, stored and sent more carefully.
Short exp plus refresh gives the balance of 'expires often, but the user doesn't log in again.'
Refresh tokens should be revocable and rotatable on the server, and kept out of JavaScript (e.g. in an HttpOnly cookie).
Try decoding a token yourself
Just paste and the header, payload and claims unfold instantly.
Open the decoder
Related
What is a JWT
A JWT (JSON Web Token) is a small, signed JSON token format for securely passing information between parties.
The three-part JWT structure
Every JWT consists of header.payload.signature, and each part is base64url encoded.
JWT security checklist
A short checklist of the key principles for using JWT safely.
JWT vs session authentication
The difference between token (JWT) auth and server session (cookie) auth, and when to use each.
Common JWT errors and fixes
The errors you meet most often when working with JWT, with their causes and fixes.