diff --git a/src/coinpay/oauth.ts b/src/coinpay/oauth.ts
index 2989109..77fce2c 100644
--- a/src/coinpay/oauth.ts
+++ b/src/coinpay/oauth.ts
@@ -96,10 +96,12 @@ export function validateCoinPayState(
   if (!received || !expected || typeof received !== "string" || typeof expected !== "string") {
     return false;
   }
-  if (received.length !== expected.length) {
-    return false;
-  }
-  return timingSafeEqual(Buffer.from(received), Buffer.from(expected));
+  const receivedBytes = Buffer.from(received);
+  const expectedBytes = Buffer.from(expected);
+  return (
+    receivedBytes.length === expectedBytes.length &&
+    timingSafeEqual(receivedBytes, expectedBytes)
+  );
 }
 
 /** Options for {@link getCoinPayAuthorizeUrl}. */
diff --git a/tests/coinpay.test.ts b/tests/coinpay.test.ts
index 56d5963..0a248d5 100644
--- a/tests/coinpay.test.ts
+++ b/tests/coinpay.test.ts
@@ -333,6 +333,7 @@ describe("generateCoinPayState / generateCoinPayPkcePair / validateCoinPayState"
     expect(validateCoinPayState(s, s)).toBe(true);
     expect(validateCoinPayState("aaaa", "bbbb")).toBe(false);
     expect(validateCoinPayState("abc", "abcd")).toBe(false);
+    expect(validateCoinPayState("é", "a")).toBe(false);
     expect(validateCoinPayState("", "x")).toBe(false);
     expect(validateCoinPayState("x", null)).toBe(false);
     expect(validateCoinPayState(undefined, undefined)).toBe(false);