"Are these the same?" is a question you ask a lot during an incident, and it is surprisingly hard to answer by eye. Two 64-character hex strings differing in one character look identical at a glance.
Comparison modes
Values directly — for checking whether a key in one environment matches another, whether a signature matches, or whether a config value survived a copy-paste.
Their digests — hashes both inputs first, then compares. Useful when the values are long, or when you want a fingerprint you can quote in a ticket without disclosing the value.
The first-difference readout
This is the diagnostic. Where two values diverge tells you what went wrong:
- Index 0 — completely different values. A different secret entirely, or a different canonical string.
- Diverging near the end — usually an encoding difference or a truncation. A
CHAR(40)column silently truncating a 43-character key produces exactly this. - Identical but different lengths — trailing whitespace or a newline. The most common copy-paste failure, and invisible in every editor.
- Same characters, different case — one side is uppercase hex. Turn off "ignore case" to see it.
Constant time, and why the page bothers
The comparison here runs in constant time even though nothing is at stake in a browser tab. It is there to model the correct behaviour, because the equivalent code on your server is a real vulnerability if it returns early.
// Vulnerable: returns as soon as bytes differ
if (received === expected) { /* ... */ }
// Correct
import { timingSafeEqual } from "node:crypto";
const a = Buffer.from(received);
const b = Buffer.from(expected);
const ok = a.length === b.length && timingSafeEqual(a, b);The timing difference is small but measurable over enough requests, and it lets an attacker recover a signature or token byte by byte. Every signature comparison, every token check, every API key lookup should use a constant-time function.
Verifying a file checksum
Paste the published checksum and the one you computed with shasum -a 256. Leave "trim whitespace" on, because published checksums usually arrive with a trailing newline and a filename after them.
A mismatch means the download was corrupted or tampered with. Do not run it.
Frequently asked questions
Why does the tool say the values differ when they look identical?
Trailing whitespace, a newline, a non-breaking space from a web page, or a Unicode look-alike character. The length readout usually reveals it immediately — two values that display the same but have different lengths have an invisible character.
Is it safe to paste real secrets?
Yes. Comparison happens in your browser and nothing is transmitted. Load the page, disconnect, and it still works.
Should I compare hashes rather than values?
For verifying two systems hold the same secret, hashing first means you can perform the comparison somewhere less trusted and quote the fingerprint in a ticket. For debugging why a signature failed, compare the raw values — you need the first-difference index.
Can this verify a bcrypt hash against a password?
No. bcrypt embeds its salt and cost in the hash and requires the bcrypt algorithm to verify. This compares values and standard digests. Use your language's bcrypt library for that.