diff --git a/pkg/login/auth.go b/pkg/login/auth.go
index 38d87444e23..f2034476f81 100644
--- a/pkg/login/auth.go
+++ b/pkg/login/auth.go
@@ -3,6 +3,7 @@ package login
 import (
 	"errors"
 
+	"crypto/subtle"
 	"github.com/grafana/grafana/pkg/bus"
 	m "github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/setting"
@@ -56,7 +57,7 @@ func loginUsingGrafanaDB(query *LoginUserQuery) error {
 	user := userQuery.Result
 
 	passwordHashed := util.EncodePassword(query.Password, user.Salt)
-	if passwordHashed != user.Password {
+	if subtle.ConstantTimeCompare([]byte(passwordHashed), []byte(user.Password)) != 1 {
 		return ErrInvalidCredentials
 	}