Skip to content

Instantly share code, notes, and snippets.

@sachinlala
Last active August 3, 2025 02:36
Show Gist options
  • Select an option

  • Save sachinlala/8a4ea79786f943877bdeaa918f416a03 to your computer and use it in GitHub Desktop.

Select an option

Save sachinlala/8a4ea79786f943877bdeaa918f416a03 to your computer and use it in GitHub Desktop.
Language / Platform Function / Method & Usage
Java β˜• MessageDigest.isEqual(byte[], byte[])
This static method securely compares two byte arrays in constant time. Always convert strings to byte arrays with a consistent encoding (e.g., UTF-8) before comparison.
JavaScript (Node.js) πŸ“œ crypto.timingSafeEqual(Buffer, Buffer)
Node.js provides this dedicated function in its crypto module. True constant-time comparison is difficult in browsers, so sensitive comparisons should be handled server-side.
Python 🐍 hmac.compare_digest(bytes, bytes)
This function securely compares two byte strings in a constant-time manner to prevent timing attacks. Ensure your inputs are byte strings.
Go 🐹 crypto/subtle.ConstantTimeCompare(a, b []byte)
Go's standard library provides this function for constant-time byte slice comparison. It returns 1 if the slices are equal and 0 otherwise.
Rust πŸ¦€ subtle::ConstantTimeEq (from the subtle crate)
This trait from the subtle crate provides a ct_eq method that performs a constant-time equality check, returning a special Choice value.
PHP 🐘 hash_equals(string, string)
Introduced in PHP 5.6, this function is designed to safely compare two strings (like hashes or tokens) in a way that resists timing attacks.
SQL πŸ—ƒοΈ ⚠️ Avoid direct comparison
Password comparison must happen in your application code, not in a SQL query. Fetch the stored hash from the database and use one of the language-specific constant-time functions above.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment