code: public static boolean secureStringEquals(String a, String b)
      {
          if (a.length() != b.length()) return false;
  
          // Prevent timing attacks by making sure the running time of this loop doesn't
          // depend on the contents of the two strings.
          int result = 0;
          for (int i = 0; i < a.length(); i++) {
              char ca = a.charAt(i);
              char cb = b.charAt(i);
              result |= (ca ^ cb);
          }
          return result == 0;
      }
docs: When you're comparing two strings for equality and one of them is a value that could be
  provided by an attacker and the other is a value that the attacker shouldn't know, use
  this function to check for equality.  Using regular {@code String.equals} is not
  secure.