.tip

a === b on two strings returns as soon as a byte differs, so the time it takes leaks how many leading bytes matched. Over enough requests, that adds up to the whole token.

import { timingSafeEqual } from "node:crypto";
const ok = a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));

Use it for webhook signatures, API keys, password reset tokens, and anything else where the caller controls one side of the comparison.