diff --git a/lib/websocket/driver/hybi.rb b/lib/websocket/driver/hybi.rb
index 3487c4a..dd0a6fe 100644
--- a/lib/websocket/driver/hybi.rb
+++ b/lib/websocket/driver/hybi.rb
@@ -243,6 +243,16 @@ def handshake_response
           raise ProtocolError.new('Missing handshake request header: Sec-WebSocket-Key')
         end
 
+        begin
+          valid_key = Base64.strict_decode64(sec_key).bytesize == 16
+        rescue ArgumentError
+          valid_key = false
+        end
+
+        unless valid_key
+          raise ProtocolError.new('Invalid handshake request header: Sec-WebSocket-Key')
+        end
+
         @headers['Upgrade']              = 'websocket'
         @headers['Connection']           = 'Upgrade'
         @headers['Sec-WebSocket-Accept'] = Hybi.generate_accept(sec_key)