This is considered best practice for languages where you can&#x27;t trust your &quot;constant time&quot; comparison won&#x27;t be optimized out from under you.<p>Performing a timing attack requires control of the bytes being compared. If you can control the bytes of the <i>output</i> of a SHA256 then there are some Bitcoin miners who will pay you a lot of money.<p>If you want to be over-the-top about it you can get some secure randomness and add it to the values being compared before hashing, and then attacker would have even less control over the bytes being compared.