diff --git a/xsrftoken/xsrf.go b/xsrftoken/xsrf.go
index bc861e1..4f66adf 100644
--- a/xsrftoken/xsrf.go
+++ b/xsrftoken/xsrf.go
@@ -20,9 +20,9 @@
 // It is exported so clients may set cookie timeouts that match generated tokens.
 const Timeout = 24 * time.Hour
 
-// clean sanitizes a string for inclusion in a token by replacing all ":"s.
+// clean sanitizes a string for inclusion in a token by replacing all ":" with "::".
 func clean(s string) string {
-	return strings.Replace(s, ":", "_", -1)
+	return strings.Replace(s, `:`, `::`, -1)
 }
 
 // Generate returns a URL-safe secure XSRF token that expires in 24 hours.
diff --git a/xsrftoken/xsrf_test.go b/xsrftoken/xsrf_test.go
index 6c8e7d9..fc0a48a 100644
--- a/xsrftoken/xsrf_test.go
+++ b/xsrftoken/xsrf_test.go
@@ -36,10 +36,32 @@
 
 // TestSeparatorReplacement tests that separators are being correctly substituted
 func TestSeparatorReplacement(t *testing.T) {
-	tok := generateTokenAtTime("foo:bar", "baz", "wah", now)
-	tok2 := generateTokenAtTime("foo", "bar:baz", "wah", now)
-	if tok == tok2 {
-		t.Errorf("Expected generated tokens to be different")
+	separatorTests := []struct {
+		name   string
+		token1 string
+		token2 string
+	}{
+		{
+			"Colon",
+			generateTokenAtTime("foo:bar", "baz", "wah", now),
+			generateTokenAtTime("foo", "bar:baz", "wah", now),
+		},
+		{
+			"Colon and Underscore",
+			generateTokenAtTime("key", ":foo:", "wah", now),
+			generateTokenAtTime("key", "_foo_", "wah", now),
+		},
+		{
+			"Colon and Double Colon",
+			generateTokenAtTime("key", ":foo:", "wah", now),
+			generateTokenAtTime("key", "::foo::", "wah", now),
+		},
+	}
+
+	for _, st := range separatorTests {
+		if st.token1 == st.token2 {
+			t.Errorf("%v: Expected generated tokens to be different", st.name)
+		}
 	}
 }