Shouldn't this be using Buffer.byteLength?

[billinghamj]

(Instead of String.prototype.length)

It seems to me that this is likely to result in the truncation of the string if any multi-byte characters are present:

https://github.com/Bruce17/safe-compare/blob/master/index.js#L54-L57

[billinghamj]

It looks like this issue was masked by the use of the binary encoding (which is lossy): nodejs/node#5504 (comment)

This works correctly:

function safeCompare(a, b) {
    var strA = String(a);
    var strB = String(b);
    
    var len = Math.max(Buffer.byteLength(strA), Buffer.byteLength(strB));
    
    var bufA = Buffer.alloc(len, strA, 'utf8');
    var bufB = Buffer.alloc(len, strB, 'utf8');
    
    return crypto.timingSafeEqual(bufA, bufB);
}

[Bruce17]

Thanks for the hint. I will update the package as soon as a find time for that.

[billinghamj]

Thanks. I have also opened a PR - #7