Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (
Help us improve Python packaging - Donate today!

Constant-time string comparison

Project Description

Sometimes you need to test strings for equality with an algorithm whose timing depends only on the length of the strings, and not on the contents of the strings themselves. If one of those strings is of constant width – an HMAC, for example – then it becomes a constant-time operation. This can be used to prevent some timing side-channel attacks, such as the critical vulnerability found in KeyCzar back in 2009.

This module offers a single function, equals(x, y), which takes two strings x and y and returns True if they are equal, and False if they are not. The time this function takes does not depend on what specific bytes are in these strings. Unicode strings are encoded as UTF-8 before being compared; it is recommended that you only use this on byte strings (str in Python 2, bytes in Python 3).

This works with Python 2 and 3, and PyPy. The license is Apache 2.0.

Release History

This version
History Node


History Node


History Node


History Node


History Node


Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Hash SHA256 Hash Help Version File Type Upload Date
(2.9 kB) Copy SHA256 Hash SHA256
Source May 21, 2013

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting