Hash Utilities

Compare Hashes

Performs constant-time hash comparison to prevent timing attacks in security-sensitive applications. Access via MCP in Cursor or Windsurf, or REST API at GET /v1/hash/compare with hash1 and hash2 parameters. Returns boolean match result without revealing comparison timing patterns, essential for password verification and authentication systems.

API Endpoint

GET /v1/hash/compare

Code Examples

curl "https://tinyfn.io/v1/hash/compare" \
  -H "X-API-Key: YOUR_API_KEY"
const response = await fetch('https://tinyfn.io/v1/hash/compare', {
  headers: { 'X-API-Key': 'YOUR_API_KEY' }
});
const data = await response.json();
console.log(data);
import requests

response = requests.get('https://tinyfn.io/v1/hash/compare',
    headers={'X-API-Key': 'YOUR_API_KEY'})
data = response.json()
print(data)

Use via MCP

Add to your AI agent

Connect your AI agent (Claude, Cursor, Windsurf, etc.) to TinyFn's hash tools:

{
  "mcpServers": {
    "tinyfn-hash": {
      "url": "https://tinyfn.io/mcp/hash",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Learn more about MCP setup →

Related Tools

Hash Md5
Generate MD5 hash of text.
Hash Sha1
Generate SHA-1 hash of text.
Hash Sha256
Generate SHA-256 hash of text.
Hash Sha384
Generate SHA-384 hash of text.
Hash Sha512
Generate SHA-512 hash of text.
Hash Sha3 256
Generate SHA3-256 hash of text.
Hash Sha3 512
Generate SHA3-512 hash of text.
Hash Blake2B
Generate BLAKE2b hash of text.

FAQ

What is constant-time hash comparison and why use it?

Constant-time comparison takes the same amount of time regardless of where hashes differ, preventing timing attacks where attackers measure response times to guess hash values. Critical for password verification and API key validation.

How do I compare password hashes securely with MCP?

Use the compare_hashes tool in your AI agent with the stored hash and user-provided hash. The tool returns true/false without leaking timing information about hash similarity.

Can I compare hashes of different lengths or algorithms?

Yes, the tool handles different hash lengths and types (MD5, SHA-256, bcrypt, etc.). It compares the raw hash bytes in constant time regardless of the hashing algorithm used.

What's the difference between regular string comparison and this tool?

Regular string comparison (==) exits early when finding differences, creating timing vulnerabilities. This tool always processes the full hash length, maintaining constant execution time.

Does the REST API return timing information?

No, GET /v1/hash/compare returns only a JSON boolean result. The constant-time guarantee applies to the comparison logic, not the HTTP response time which varies due to network factors.

Try Compare Hashes Now

Get your free API key and start using Compare Hashes in seconds.

Get Free API Key