Why long-lived JWTs stay valid after theft and how refresh token rotation helps

A stateless JWT is checked only by its signature and expiry, so a stolen token stays usable until it expires even after a password change. Shortening access token lifetimes alone hurts user experience, so applications pair short-lived access tokens with longer-lived refresh tokens. Rotation issues a new refresh token on every refresh, letting servers detect when an already-used token reappears and revoke the affected session. The approach also raises practical issues such as network retries mistaken for theft, simultaneous browser tabs, and sessions that never expire, which require careful design. Storing the refresh token in an httpOnly secure cookie and the access token in memory further limits exposure.