Secure Compare Tool
Compare two secrets, tokens or passwords using a constant-time equality check instead of a plain string comparison, with optional trimming/case normalization and SHA-256 fingerprints for diagnostics. Runs entirely in your browser.
Input
Fingerprints are diagnostic only — they don't make pasted secrets safe to share.
Output
| Metric | Value |
|---|---|
| No data yet | |
Guides
The Secure Compare Tool checks whether two values — API keys, tokens, password hashes, webhook secrets — are identical, using a constant-time comparison instead of a plain === check. It's built for the case where you need to eyeball whether two secrets match without pasting them into a naive text diff.
Why not just compare them by eye or with ===?
A normal string comparison (and eyeballing two long tokens side by side) stops at the first character that differs, which is fine for a UI but is exactly the kind of shortcut that makes timing attacks possible in server-side authentication code. This tool always walks the full length of both values and XORs every character position together, so the result doesn't depend on where the first mismatch occurs — the same defensive pattern behind crypto.timingSafeEqual and libsodium's sodium_memcmp, useful here for spot-checking that your own comparison logic is doing the right thing.
How to use it
- Paste the two values into Value A and Value B.
- Pick a normalization mode if the values might differ only in formatting:
- Exact — compare the values exactly as pasted.
- Trim leading/trailing spaces — ignore accidental whitespace from copy-paste.
- Trim + lowercase — also ignore case, useful for hex-encoded values.
- Turn on Show SHA-256 fingerprints to get a hash of each value — handy for confirming two secrets match without displaying either one in full elsewhere.
- Read the Match result, plus the length of each value. Use the copy or download button to export the comparison as CSV.
Is my data private?
Yes. All comparison and hashing happens locally in your browser — neither value is ever uploaded to a server. Share links only carry your normalization/fingerprint settings, never the pasted values themselves.
Do the SHA-256 fingerprints make it safe to share a secret?
No. A SHA-256 fingerprint is a diagnostic aid for confirming two values match without displaying either one — it is not a safe way to publish or transmit the underlying secret. Treat any value you paste here with the same care you'd give the original.
Is this meant for comparing large files or long documents?
No. It's built for comparing individual secrets, tokens or short strings — for comparing full documents, use a dedicated text or file diff tool instead.