diff --git a/hmac_utils.cpp b/hmac_utils.cpp
index da4ee8d..46ec8bc 100644
--- a/hmac_utils.cpp
+++ b/hmac_utils.cpp
@@ -6,10 +6,12 @@
 namespace hmac {
  
     bool constant_time_equals(const std::string &a, const std::string &b) {
-        if (a.size() != b.size()) return false;
-        unsigned char diff = 0;
-        for (size_t i = 0; i < a.size(); ++i) {
-            diff |= static_cast<unsigned char>(a[i]) ^ static_cast<unsigned char>(b[i]);
+        size_t max_len = a.size() > b.size() ? a.size() : b.size();
+        unsigned char diff = static_cast<unsigned char>(a.size() ^ b.size());
+        for (size_t i = 0; i < max_len; ++i) {
+            unsigned char ac = i < a.size() ? static_cast<unsigned char>(a[i]) : 0;
+            unsigned char bc = i < b.size() ? static_cast<unsigned char>(b[i]) : 0;
+            diff |= ac ^ bc;
         }
         return diff == 0;
     }
diff --git a/test_all.cpp b/test_all.cpp
index 91e8777..7ba03b2 100644
--- a/test_all.cpp
+++ b/test_all.cpp
@@ -23,6 +23,15 @@ TEST(UtilsTest, ToHex) {
     EXPECT_EQ(hmac::to_hex("012345"), "303132333435");
 }
 
+TEST(UtilsTest, ConstantTimeEqualsMatch) {
+    EXPECT_TRUE(hmac::constant_time_equals("alpha", "alpha"));
+}
+
+TEST(UtilsTest, ConstantTimeEqualsMismatch) {
+    EXPECT_FALSE(hmac::constant_time_equals("alpha", "beta"));
+    EXPECT_FALSE(hmac::constant_time_equals("alpha", "alphabet"));
+}
+
 TEST(HMACTest, SHA256) {
     const std::string key = "12345";
     const std::string input = "grape";