PHPCon Poland 2024


(PHP 7 >= 7.2.0, PHP 8)

sodium_memcmpTest for equality in constant-time


sodium_memcmp(#[\SensitiveParameter] string $string1, #[\SensitiveParameter] string $string2): int

Compare two strings in constant-time.

In practice, you almost always want to use hash_equals() instead, since it provides the same logic but returns a bool instead of an int. However, if you're using the return value of a comparison in a calculation that's timing-sensitive, and worried about timing leaks with bool-to-int conversions, sodium_memcmp() is an ideal replacement.



String to compare


Other string to compare

Valores devueltos

Returns 0 if both strings are equal; -1 otherwise.

add a note

User Contributed Notes 1 note

divinity76 at gmail dot com
4 years ago
seems to me that this function does the same as the hash_equals() function. hash_equals() has nothing to do with hashes really, it is just a constant-time string equality check function, apparently like sodium_memcmp()
To Top