Unlike passwords, token leaks are often difficult for users to detect, and even if the password is changed afterward, already-leaked tokens can still be abused before they expire.