diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 648daed..31773fe 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -351,9 +351,6 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
                                              const char *service,
                                              char **outptr, size_t *outlen)
 {
-#ifndef DEBUGBUILD
-  static const char table16[] = "0123456789abcdef";
-#endif
   CURLcode result = CURLE_OK;
   size_t i;
   MD5_context *ctxt;
@@ -364,21 +361,27 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
   char resp_hash_hex[2 * MD5_DIGEST_LEN + 1];
 
   char nonceCount[] = "00000001";
-  char cnonce[]     = "12345678"; /* will be changed */
+  char *cnonce = NULL;
+  size_t cnoncelen;
   char method[]     = "AUTHENTICATE";
   char qop[]        = "auth";
   char uri[128];
+  unsigned int entropy[2];
 
-#ifndef DEBUGBUILD
-  /* Generate 64 bits of random data */
-  for(i = 0; i < 8; i++)
-    cnonce[i] = table16[Curl_rand(data)%16];
-#endif
+  entropy[0] = Curl_rand(data);
+  entropy[1] = Curl_rand(data);
+
+  result = Curl_base64_encode(data, (const char *)&entropy[0], 8,
+                              &cnonce, &cnoncelen);
+  if(result)
+    goto fail;
 
   /* So far so good, now calculate A1 and H(A1) according to RFC 2831 */
   ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
-  if(!ctxt)
-    return CURLE_OUT_OF_MEMORY;
+  if(!ctxt) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
 
   Curl_MD5_update(ctxt, (const unsigned char *) userp,
                   curlx_uztoui(strlen(userp)));
@@ -391,8 +394,10 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
   Curl_MD5_final(ctxt, digest);
 
   ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
-  if(!ctxt)
-    return CURLE_OUT_OF_MEMORY;
+  if(!ctxt) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
 
   Curl_MD5_update(ctxt, (const unsigned char *) digest, MD5_DIGEST_LEN);
   Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
@@ -412,8 +417,10 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
 
   /* Calculate H(A2) */
   ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
-  if(!ctxt)
-    return CURLE_OUT_OF_MEMORY;
+  if(!ctxt) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
 
   Curl_MD5_update(ctxt, (const unsigned char *) method,
                   curlx_uztoui(strlen(method)));
@@ -427,8 +434,10 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
 
   /* Now calculate the response hash */
   ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
-  if(!ctxt)
-    return CURLE_OUT_OF_MEMORY;
+  if(!ctxt) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
 
   Curl_MD5_update(ctxt, (const unsigned char *) HA1_hex, 2 * MD5_DIGEST_LEN);
   Curl_MD5_update(ctxt, (const unsigned char *) ":", 1);
@@ -457,13 +466,18 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
                      "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s",
                      userp, realm, nonce,
                      cnonce, nonceCount, uri, resp_hash_hex);
-  if(!response)
-    return CURLE_OUT_OF_MEMORY;
+  if(!response) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto fail;
+  }
 
   /* Base64 encode the response */
   result = Curl_base64_encode(data, response, 0, outptr, outlen);
 
-  Curl_safefree(response);
+  fail:
+
+  free(response);
+  free(cnonce);
 
   return result;
 }