You're using the Stanford library, right?  I suggest [sjcl.bn.equals()](http://bitwiseshiftleft.github.io/sjcl/doc/symbols/sjcl.bn.html#equals) to do a constant-time operation.

Now, if you reaaaaaly want to do it by hand... There's an number of ways you can do constant time comparisons.  My favorite uses the property that bitwise-XORing a byte by itself gives you zero.  Step through one byte at a time, xor the two bytes you want to compare, and add the result to a running accumulator.  If the accumulator is nonzero at the end, there had to have been a mismatch, and you fail.  [Fernet does this](https://github.com/fernet/fernet-rb/blob/c64c306c70b66f4555ac978a107ceeb6eb38e50b/lib/fernet/verifier.rb#L65-70).  In JS, I think it'd look like this...

```
accum = 0
for(var i=0;i<64;i++){
  accum += decodedHmacHex[i] ^ this.hmacHex[i]
}
if(fail != 0){
  throw new Error("Invalid Token: HMAC");
}
```