# Implement refresh token rotation

**URL:** <https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643>\
**Category:** Feature Requests\
**Created:** [May 20, 2024, 6:21pm UTC](https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643 "2024-05-20T18:21:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivulit](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ivulit/32/1437_2.png) [@ivulit](https://vaultwarden.discourse.group/u/ivulit)\
**Post date:** [May 20, 2024, 6:21pm UTC](https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643/1 "2024-05-20T18:21:34Z")

</div>

Hello.I might be mistaken, but I think Vaultwarden uses refresh tokens that never change. What do you think about implementing rotating refresh tokens? Bitwarden uses rotating ones

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [May 20, 2024, 7:00pm UTC](https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643/2 "2024-05-20T19:00:41Z")

</div>

There is already a PR for that. It only needs to be checked and verified.

---

<div class="post-metadata">

**Author:** ![ivulit](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ivulit/32/1437_2.png) [@ivulit](https://vaultwarden.discourse.group/u/ivulit)\
**Post date:** [May 20, 2024, 7:29pm UTC](https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643/3 "2024-05-20T19:29:46Z")

</div>

Good news.  
Thanks for your quick feedback!

---

<div class="post-metadata">

**Author:** ![ivulit](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ivulit/32/1437_2.png) [@ivulit](https://vaultwarden.discourse.group/u/ivulit)\
**Post date:** [December 28, 2025, 3:16pm UTC](https://vaultwarden.discourse.group/t/implement-refresh-token-rotation/3643/4 "2025-12-28T15:16:05Z")

</div>

Hi! Is there any update on the refresh token rotation PR? Has it been merged yet, or are there any blockers preventing its implementation?