Compare secrets in constant time

Javascript

A plain === leaks how much of the token matched through its timing. This does not.

const { timingSafeEqual } = require('node:crypto');

function safeEqual(a, b) {
  const ba = Buffer.from(a);
  const bb = Buffer.from(b);
  if (ba.length !== bb.length) return false;
  return timingSafeEqual(ba, bb);
}

Download

Security security timing crypto chris

More in Security

A starting Content-Security-Policy Security Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing. Check a file's checksum Security Verifies a download actually matches what the publisher signed, rather than trusting the transfer. Generate a strong random secret Security For session keys and tokens. Never reach for a password generator or a UUID for this. Generate an SSH key and add it to the agent Security Ed25519 rather than RSA: shorter, faster, and no key-size decision to get wrong. Security headers for an Express app Security The handful worth setting even when you are not using a framework that sets them for you.

Random picks

Exhaustiveness check on a switch TypeScript Assigning to never makes the compiler fail the build when a new union member is added and left unhandled. Rewrite a CSV column with perl Text Processing A one-liner that upper-cases the second field of every row, leaving the rest alone. Stop tracking a file without deleting it Git For the config file that should never have been committed. Add it to .gitignore afterwards. Async/await with a task group in Swift Systems Runs the downloads concurrently and collects them, with cancellation propagating to all of them. Hash and verify a password in PHP PHP password_hash picks the algorithm and the salt. Never store anything a hash function can reverse. A semantic, accessible form field Web & CSS The label is tied to the input by id, and the hint is announced with it via aria-describedby. Amend a commit without changing its message Git Adds forgotten files to the previous commit and leaves the message exactly as it was. Upsert a row in SQLite Databases Inserts, or updates the existing row when the unique column already holds that value.