diff --git a/modules/mfa/src/Auth/Process/Mfa.php b/modules/mfa/src/Auth/Process/Mfa.php
index b1b64fbe..9f41950c 100644
--- a/modules/mfa/src/Auth/Process/Mfa.php
+++ b/modules/mfa/src/Auth/Process/Mfa.php
@@ -787,8 +787,9 @@ public static function isRememberMeCookieValid(
         if (!empty($cookieHash) && !empty($expireDate) && is_numeric($expireDate)) {
             // Check if value of expireDate is in future
             if ((int)$expireDate > time()) {
-                $expectedString = self::generateRememberMeCookieString($rememberSecret, $state['employeeId'], $expireDate, $mfaOptions);
-                $isValid = password_verify($expectedString, $cookieHash);
+                $expectedString = self::generateRememberMeCookieString($state['employeeId'], $expireDate, $mfaOptions);
+                $expectedHash = hash_hmac('sha256', $expectedString, $rememberSecret);
+                $isValid = hash_equals($expectedHash, $cookieHash);
 
                 if ($isValid) {
                     $idBrokerClient = self::getIdBrokerClient($state['idBrokerConfig']);
@@ -804,14 +805,12 @@ public static function isRememberMeCookieValid(
 
     /**
      * Generate and return a string to be hashed for remember me cookie
-     * @param string $rememberSecret
      * @param string $employeeId
      * @param int $expireDate
      * @param array $mfaOptions
      * @return string
      */
     public static function generateRememberMeCookieString(
-        string $rememberSecret,
         string $employeeId,
         int    $expireDate,
         array  $mfaOptions
@@ -823,7 +822,7 @@ public static function generateRememberMeCookieString(
             }
         }
 
-        return $rememberSecret . $employeeId . $expireDate . $allMfaIds;
+        return $employeeId . '|' . $expireDate . '|' . $allMfaIds;
     }
 
     /**
@@ -887,8 +886,8 @@ public static function setRememberMeCookies(
         $rememberSecret = Env::requireEnv('REMEMBER_ME_SECRET');
         $secureCookie = Env::get('SECURE_COOKIE', true);
         $expireDate = strtotime($rememberDuration);
-        $cookieString = self::generateRememberMeCookieString($rememberSecret, $employeeId, $expireDate, $mfaOptions);
-        $cookieHash = password_hash($cookieString, PASSWORD_DEFAULT);
+        $cookieString = self::generateRememberMeCookieString($employeeId, $expireDate, $mfaOptions);
+        $cookieHash = hash_hmac('sha256', $cookieString, $rememberSecret);
         setcookie('c1', base64_encode($cookieHash), $expireDate, '/', null, $secureCookie, true);
         setcookie('c2', $expireDate, $expireDate, '/', null, $secureCookie, true);
     }
diff --git a/modules/mfa/tests/MfaTest.php b/modules/mfa/tests/MfaTest.php
index b2b6b8d7..6b08e0b0 100644
--- a/modules/mfa/tests/MfaTest.php
+++ b/modules/mfa/tests/MfaTest.php
@@ -137,12 +137,11 @@ public function testIsRememberMeCookieValid_ValidCookie_UpdatesLastLogin(): void
         putenv('REMEMBER_ME_SECRET=test-secret-for-unit-test');
         try {
             $expectedString = Mfa::generateRememberMeCookieString(
-                'test-secret-for-unit-test',
                 $employeeId,
                 $expireDate,
                 $mfaOptions
             );
-            $cookieHash = password_hash($expectedString, PASSWORD_DEFAULT);
+            $cookieHash = hash_hmac('sha256', $expectedString, (string)getenv('REMEMBER_ME_SECRET'));
 
             $isValid = Mfa::isRememberMeCookieValid(
                 $cookieHash,