The Uniqueness of Refresh Token

This article clarifies whether the refresh token is unique and if it can be reused/recycled by Auth0.

There are 2 types of refresh tokens -- the non-rotating refresh token and rotating refresh token -- neither of them are unique technically, but the probability of duplication is consider to be close enough to zero.

It's similar to UUID (aka GUID) for example, it is consisted of 128 bit of random data, so technically it is not unique either, however, they are still used an unique ID. 

According to this article: 

• "When generated according to the standard methods, UUIDs are, for practical purposes, unique."
• "While the probability that a UUID will be duplicated is not zero, it is generally considered close enough to zero to be negligible."