diff --git a/app/auth.py b/app/auth.py
index d579722..b2c117a 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -35,4 +35,4 @@ def make_share_token(note_id: int) -> str:
 
 def check_share_token(supplied: str, expected: str) -> bool:
     """Validate a share token supplied in a URL."""
-    return supplied == expected
+    return hmac.compare_digest(supplied, expected)