I will try in simple words. Authorization Code flow should be used by applications where you have a backend (like ASP.NET MVC, Spring,). This flow uses intermediate code value which in the backed will be exchanged to access token. After that access token can be stored securely in application backed and used whenever is needed. In this use case, access token is never exposed to the browser (if application will not reveal it).

Implicit flow send back the access token directly in the authentication response. When used in browser app (applications without a backend) it is necessary to store it securely which is not that easy. In this case it is adviced to use PKCS instead and short-lived access tokens.

Latest advice from OAuth2 designers is also to use PKCS to not

I will try in simple words. Authorization Code flow should be used by applications where you have a backend (like ASP.NET MVC, Spring,). This flow uses intermediate code value which in the backed will be exchanged to access token. After that access token can be stored securely in application backed and used whenever is needed. In this use case, access token is never exposed to the browser (if application will not reveal it).

Implicit flow send back the access token directly in the authentication response. When used in browser app (applications without a backend) it is necessary to store it securely which is not that easy. In this case it is adviced to use PKCS instead and short-lived access tokens.