diff --git a/crypto/src/main/java/org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.java b/crypto/src/main/java/org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.java
index 54735f19b2..8fa55069ba 100644
--- a/crypto/src/main/java/org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.java
+++ b/crypto/src/main/java/org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.java
@@ -24,6 +24,7 @@ import com.password4j.BalloonHashingFunction;
 import com.password4j.Hash;
 import com.password4j.Password;
 
+import org.springframework.security.crypto.codec.Utf8;
 import org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder;
 import org.springframework.util.Assert;
 
@@ -140,7 +141,7 @@ public class BalloonHashingPassword4jPasswordEncoder extends AbstractValidatingP
 			String expectedHash = parts[1];
 
 			Hash hash = Password.hash(rawPassword).addSalt(salt).with(this.balloonHashingFunction);
-			return expectedHash.equals(hash.getResult());
+			return Utf8.isEqual(expectedHash, hash.getResult());
 		}
 		catch (IllegalArgumentException ex) {
 			// Invalid Base64 encoding
diff --git a/crypto/src/main/java/org/springframework/security/crypto/password4j/Pbkdf2Password4jPasswordEncoder.java b/crypto/src/main/java/org/springframework/security/crypto/password4j/Pbkdf2Password4jPasswordEncoder.java
index 65fbaa98e9..37efbb27c4 100644
--- a/crypto/src/main/java/org/springframework/security/crypto/password4j/Pbkdf2Password4jPasswordEncoder.java
+++ b/crypto/src/main/java/org/springframework/security/crypto/password4j/Pbkdf2Password4jPasswordEncoder.java
@@ -24,6 +24,7 @@ import com.password4j.Hash;
 import com.password4j.PBKDF2Function;
 import com.password4j.Password;
 
+import org.springframework.security.crypto.codec.Utf8;
 import org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder;
 import org.springframework.util.Assert;
 
@@ -138,7 +139,7 @@ public class Pbkdf2Password4jPasswordEncoder extends AbstractValidatingPasswordE
 			String expectedHash = parts[1];
 
 			Hash hash = Password.hash(rawPassword).addSalt(salt).with(this.pbkdf2Function);
-			return expectedHash.equals(hash.getResult());
+			return Utf8.isEqual(expectedHash, hash.getResult());
 		}
 		catch (IllegalArgumentException ex) {
 			// Invalid Base64 encoding