Function verify 

pub fn verify(plaintext: &str, stored_hash: &str) -> bool

Constant-time check that plaintext hashes to stored_hash.

Hashes plaintext and compares the two raw 32-byte digests in fixed time (via hmac’s verify_slice), so the comparison can’t leak a partial match through timing. A malformed (non-hex / wrong-length) stored_hash simply fails — never panics. See the module docs for why this is not a String ==.