Search code examples
jwttokenaccess-token

What is encoded in refresh token


As far as I know the auth token consists of JSON header, payload and signature encoded in base64. But what is encoded in a refresh token?


Solution

  • Refresh tokens are often either opaque tokens (not meant to be decoded or decrypted) or reference tokens identifiying a record in the db. It should at least have the information about the authenticated user and the expiration of the token itself.

    The acces token format you're talking about is JWT (JSON Web Token). But that's not allways the case, often access tokens are also opaque or reference tokens.

    And sometimes (seldom) refresh tokens also come as a JWT.

    See Understanding the different token formats