diff --git a/doc/api/crypto.md b/doc/api/crypto.md index 5ae5ad6b7a99ee..6bc66ab52a3a5f 100644 --- a/doc/api/crypto.md +++ b/doc/api/crypto.md @@ -3068,7 +3068,11 @@ comparing HMAC digests or secret values like authentication cookies or [capability urls](https://www.w3.org/TR/capability-urls/). `a` and `b` must both be `Buffer`s, `TypedArray`s, or `DataView`s, and they -must have the same length. +must have the same byte length. + +If at least one of `a` and `b` is a `TypedArray` with more than one byte per +entry, such as `Uint16Array`, the result will be computed using the platform +byte order. Use of `crypto.timingSafeEqual` does not guarantee that the *surrounding* code is timing-safe. Care should be taken to ensure that the surrounding code does