title: Why use JWT refresh token
body: <p>I'm not sure I understand the concept of refresh tokens. I know what they do - store them somewhere and whenever the access token expires, get a new access token with them.</p>
  
  <p>It is obviously very important to not leak this refresh token because otherwise a third party could obtain a new access token with it. Therefore it need to be kept extra safe.</p>
  
  <p>My question is: Why not just keep a long lived access token extra safe? Where is the difference in security?</p>
  
  <p>Here is how this fact is described by auth0.com e.g.:</p>
  
  <blockquote>
    <p>Benefit: Shorter windows of access for leaked access tokens (these expire quickly, reducing the chance of a leaked token allowing access to a protected resource)"</p>
  </blockquote>
  
  <p>That does not make any sense to me. So the access token expires quickly and therefore it is "not bad" if it is leaked.</p>
  
  <p>On the other hand it is very bad if the refresh token is leaked. So why not just try to keep the access token as safe as the refresh token and have the exact same outcome but one less token to manage?</p>