When comparing hashes, you can still have timing differences. You have to actually compare the whole string, drag the comparison result along and evaluate it at

When comparing hashes, you can still have timing differences. You have to actually compare the whole string, drag the comparison result along and evaluate it at the very end. And make sure the compiler is not "helping". But this would give no knowledge of how long the matching prefix is. The hash should indeed mask that.