Duolingo Learned Words

JWT Token:

Your JWT token serves as a key to access the Duolingo API on behalf of your account. The API requests are processed by a server-side worker running on Cloudflare, rather than directly from your browser.
Due to CORS restrictions, most web browsers don't allow direct cross-origin requests to the Duolingo API, which is why the server-side worker is necessary. (If you're aware of an alternative client-side method, please let me know)
To optimize performance and reduce API calls, a hashed (in a not very secure way) version of your JWT token, along with your learned words in plain text, are cached for 10 minutes.
You can review the source code here.
The JWT token typically remains consistent across different login sessions and is only refreshed when you change your password.
Therefore, if you are sharing your JWT token with someone else, you should change your password (even to the same you had before) to invalidate the old JWT token.