When. Morning and evening, and it is also widely recited after the obligatory prayers and before sleep. It is not a supplication in form — it is a verse of the Qur'an, al-Baqara 2:255, recited as remembrance rather than composed as a request.
The words. Al-Hayy is life as an attribute, not as a state something is in: the One who is living, without having been given life. Al-Qayyum comes from the root q-w-m, to stand, in an intensive form — the One who stands by Himself and by whom everything else stands. English needs two ideas, self-subsistence and sustaining others, where Arabic uses one word.
Then sinah before nawm. Sinah is not sleep; it is the drowsiness that precedes it, the head beginning to dip. The order matters: the verse denies the faintest onset of it before denying sleep itself, closing the smaller door before the larger one.
Why it reads as protection. The verse does not mention protection anywhere. Its content is entirely who Allah is — living, unsleeping, owner of the heavens and the earth. That is the whole mechanism: what makes a person safe is not a formula pronounced over them but the fact being stated.
On its length. The full verse runs considerably longer than the portion printed here, through the intercession clause, the throne, and the closing lines. Reciting it means reciting all of it.
Common confusion. Ayat al-Kursi is one verse, not a chapter, and it is not the same as the closing verses of al-Baqara, which are also commonly recited at night.