or-of-xor's is the traditional approach, from PHP's password_verify: for (i = 0; i < hash_len; i++) { status |= (ret[i] ^ hash[i]); } This works well

or-of-xor's is the traditional approach, from PHP's password_verify: for (i = 0; i < hash_len; i++) { status |= (ret[i] ^ hash[i]); } This works well enough, and doing something more clever runs the risk of the compiler optimizing out padding code.