Access token = day pass, quick to expire. Refresh token = member card the desk can cancel.

A JWT is verified without asking a database, so nobody can recall one once it is out. Keeping the access token to minutes limits what a thief can do with it. The refresh token is a record kept on the server, so the server can cancel it, and the thief cannot get new passes. Unlike a real day pass, the access token needs no stamp from the desk to work.

Read it once, then a question tests whether the trick stuck.