diff --git a/contrib/credential/wincred/git-credential-wincred.c b/contrib/credential/wincred/git-credential-wincred.c
index 22eb27ca31dea0..cd72e71ecd548b 100644
--- a/contrib/credential/wincred/git-credential-wincred.c
+++ b/contrib/credential/wincred/git-credential-wincred.c
@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <io.h>
 #include <fcntl.h>
+#include <wchar.h>
 #include <wincred.h>
 
 /* common helpers */
@@ -69,6 +70,72 @@ static void write_item(const char *what, LPCWSTR wbuf, int wlen)
 	free(buf);
 }
 
+/*
+ * Write known credential item.
+ */
+static void write_credential_item(LPCWSTR data, int wlen)
+{
+	static const LPCWSTR refresh_token = L"oauth_refresh_token";
+	LPCWSTR value;
+	DWORD klen;
+	DWORD vlen;
+
+	/* find key/value separator for credential item */
+	if ((value = wmemchr(data, L'=', wlen)) == NULL)
+		return;
+	klen = value++ - data;
+	vlen = wlen - klen - 1;
+
+	/* write items known to git credential protocol */
+	if (klen == wcslen(refresh_token) && wmemcmp(data, refresh_token, klen) == 0)
+		write_item("oauth_refresh_token", value, vlen);
+}
+
+/*
+ * Write single credential block
+ * consisting of password and further (accepted) credential items.
+ */
+static void write_credential(const CREDENTIALW *cred)
+{
+	LPCWSTR end;
+	DWORD length;
+	LPCWSTR blob = (LPCWSTR)cred->CredentialBlob;
+	DWORD wlen = cred->CredentialBlobSize / sizeof(WCHAR);
+
+	/* check if content is single line */
+	if ((end = wmemchr(blob, L'\n', wlen)) == NULL) {
+		write_item("password", blob, wlen);
+		return;
+	}
+	/* determine current line length and remaining data size */
+	length = end++ - blob;
+	wlen -= length + 1;
+
+	/* skip carriage return at line end */
+	if (length && blob[length - 1] == L'\r')
+		--length;
+	write_item("password", blob, length);
+
+	while (1) {
+		/* key/value content starts on next line */
+		blob = end;
+
+		/* find line end */
+		if ((end = wmemchr(blob, L'\n', wlen)) == NULL) {
+			write_credential_item(blob, wlen);
+			return;
+		}
+		/* determine current line length and remaining data size */
+		length = end++ - blob;
+		wlen -= length + 1;
+
+		// skip carriage return at line end
+		if (length && blob[length - 1] == L'\r')
+			--length;
+		write_credential_item(blob, length);
+	}
+}
+
 /*
  * Match an (optional) expected string and a delimiter in the target string,
  * consuming the matched text by updating the target pointer.
@@ -148,51 +215,32 @@ static void get_credential(void)
 {
 	CREDENTIALW **creds;
 	DWORD num_creds;
-	int i;
-	CREDENTIAL_ATTRIBUTEW *attr;
-	WCHAR *secret;
-	WCHAR *line;
-	WCHAR *remaining_lines;
-	WCHAR *part;
-	WCHAR *remaining_parts;
 
 	if (!CredEnumerateW(L"git:*", 0, &num_creds, &creds))
 		return;
 
-	/* search for the first credential that matches username */
-	for (i = 0; i < num_creds; ++i)
-		if (match_cred(creds[i], 0)) {
-			write_item("username", creds[i]->UserName,
-				creds[i]->UserName ? wcslen(creds[i]->UserName) : 0);
-			if (creds[i]->CredentialBlobSize > 0) {
-				secret = xmalloc(creds[i]->CredentialBlobSize + sizeof(WCHAR));
-				wcsncpy_s(secret, creds[i]->CredentialBlobSize, (LPCWSTR)creds[i]->CredentialBlob, creds[i]->CredentialBlobSize / sizeof(WCHAR));
-				line = wcstok_s(secret, L"\r\n", &remaining_lines);
-				write_item("password", line, line ? wcslen(line) : 0);
-				while(line != NULL) {
-					part = wcstok_s(line, L"=", &remaining_parts);
-					if (!wcscmp(part, L"oauth_refresh_token")) {
-						write_item("oauth_refresh_token", remaining_parts, remaining_parts ? wcslen(remaining_parts) : 0);
-					}
-					line = wcstok_s(NULL, L"\r\n", &remaining_lines);
-				}
-				free(secret);
-			} else {
-				write_item("password",
-						(LPCWSTR)creds[i]->CredentialBlob,
-						creds[i]->CredentialBlobSize / sizeof(WCHAR));
-			}
-			for (int j = 0; j < creds[i]->AttributeCount; j++) {
-				attr = creds[i]->Attributes + j;
-				if (!wcscmp(attr->Keyword, L"git_password_expiry_utc")) {
-					write_item("password_expiry_utc", (LPCWSTR)attr->Value,
-					attr->ValueSize / sizeof(WCHAR));
-					break;
-				}
+	/* search for the first credential that matches target and username */
+	for (int i = 0; i < num_creds; ++i) {
+		LPCWSTR username;
+
+		if (!match_cred(creds[i], 0))
+			continue;
+
+		username = creds[i]->UserName;
+		write_item("username", username, username ? wcslen(username) : 0);
+
+		write_credential(creds[i]);
+
+		for (int j = 0; j < creds[i]->AttributeCount; j++) {
+			CREDENTIAL_ATTRIBUTEW *attr = creds[i]->Attributes + j;
+
+			if (!wcscmp(attr->Keyword, L"git_password_expiry_utc")) {
+				write_item("password_expiry_utc", (LPCWSTR)attr->Value, attr->ValueSize / sizeof(WCHAR));
+				break;
 			}
-			break;
 		}
-
+		break;
+	}
 	CredFree(creds);
 }