diff --git a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
index 527fffd..effa8a7 100644
--- a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
+++ b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
@@ -64,7 +64,7 @@ public function setCurrentUser(AccountInterface $current_user = NULL) {
    *   (optional) An additional value to base the token on.
    *
    * @return string
-   *   A 43-character URL-safe token for validation, based on the user session
+   *   A 56-character URL-safe token for validation, based on the user session
    *   ID, the hash salt provided by drupal_get_hash_salt(), and the
    *   'drupal_private_key' configuration variable.
    *
@@ -72,7 +72,14 @@ public function setCurrentUser(AccountInterface $current_user = NULL) {
    * @see drupal_session_start()
    */
   public function get($value = '') {
-    return Crypt::hmacBase64($value, session_id() . $this->privateKey->get() . drupal_get_hash_salt());
+    // 42 bytes results in a base64 encoding with no trailing = characters.
+    $mask = Crypt::randomBytes(21);
+    $secret = $this->getSecret($value);
+    return strtr(base64_encode(($mask ^ $secret) . $mask), array('+' => '-', '/' => '_'));
+  }
+
+  protected function getSecret($value = '') {
+    return substr(hash_hmac('sha256', $value, session_id() . $this->privateKey->get() . drupal_get_hash_salt(), TRUE), 0, 21);
   }
 
   /**
@@ -90,7 +97,13 @@ public function get($value = '') {
    *   is TRUE, the return value will always be TRUE for anonymous users.
    */
   public function validate($token, $value = '', $skip_anonymous = FALSE) {
-    return ($skip_anonymous && $this->currentUser->isAnonymous()) || ($token === $this->get($value));
+    if ($skip_anonymous && $this->currentUser->isAnonymous()) {
+      return TRUE;
+    }
+    $binary_token = base64_decode(strtr($token, array('-' => '+', '_' => '/')));
+    $mask = substr($binary_token, 21);
+    $secret = substr($binary_token, 0, 21) ^ $mask;
+    return ($secret === $this->getSecret($value));
   }
 
 }