Hello, On https://github.com/WordPress/two-factor/blob/cf55e92bef8f44ffeed2d4f144dc177a4cb742ca/providers/class-two-factor-email.php#L190 the hashes are compared with `!==`. It seems better to compare them with the function `hash_equals` instead. Nicolas,