diff --git a/config/user.go b/config/user.go
index 3183fde..1ef3de3 100644
--- a/config/user.go
+++ b/config/user.go
@@ -33,7 +33,6 @@ package config
 
 import (
 	"encoding/base64"
-	"net/url"
 
 	"git.happydns.org/happydomain/model"
 )
@@ -41,11 +40,11 @@ import (
 // GetAccountRecoveryURL returns the absolute URL corresponding to the recovery
 // URL of the given account.
 func (o *Options) GetAccountRecoveryURL(u *happydns.UserAuth) string {
-	return o.BuildURL_noescape("/forgotten-password?u=%s&k=%s", base64.RawURLEncoding.EncodeToString(u.Id), url.QueryEscape(u.GenAccountRecoveryHash(false)))
+	return o.BuildURL_noescape("/forgotten-password?u=%s&k=%s", base64.RawURLEncoding.EncodeToString(u.Id), u.GenAccountRecoveryHash(false))
 }
 
 // GetRegistrationURL returns the absolute URL corresponding to the e-mail
 // validation page of the given account.
 func (o *Options) GetRegistrationURL(u *happydns.UserAuth) string {
-	return o.BuildURL_noescape("/email-validation?u=%s&k=%s", base64.RawURLEncoding.EncodeToString(u.Id), url.QueryEscape(u.GenRegistrationHash(false)))
+	return o.BuildURL_noescape("/email-validation?u=%s&k=%s", base64.RawURLEncoding.EncodeToString(u.Id), u.GenRegistrationHash(false))
 }
diff --git a/model/userauth.go b/model/userauth.go
index 1271602..7ba0693 100644
--- a/model/userauth.go
+++ b/model/userauth.go
@@ -144,7 +144,7 @@ func (u *UserAuth) GenRegistrationHash(previous bool) string {
 		[]byte(u.CreatedAt.Format(time.RFC3339Nano)),
 	)
 	h.Write(date.AppendFormat([]byte{}, time.RFC3339))
-	return base64.StdEncoding.EncodeToString(h.Sum(nil))
+	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
 }
 
 // ValidateEmail tries to validate the email address by comparing the given key to the expected one.
@@ -186,7 +186,7 @@ func (u *UserAuth) GenAccountRecoveryHash(previous bool) string {
 		u.PasswordRecoveryKey,
 	)
 	h.Write(date.AppendFormat([]byte{}, time.RFC3339))
-	return base64.StdEncoding.EncodeToString(h.Sum(nil))
+	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
 }
 
 // CanRecoverAccount checks if the given key is a valid recovery hash.