diff --git a/lib/commands/quota.js b/lib/commands/quota.js
index 5c39a8d93..97213e02b 100644
--- a/lib/commands/quota.js
+++ b/lib/commands/quota.js
@@ -3,6 +3,7 @@
 const Quota = module.exports;
 
 const Util = require("../common-util");
+const Keys = require("../keys");
 const Package = require('../../package.json');
 const Https = require("https");
 
@@ -19,11 +20,18 @@ Quota.applyCustomLimits = function (Env) {
     var customLimits = (function (custom) {
         var limits = {};
         Object.keys(custom).forEach(function (k) {
-            k.replace(/\/([^\/]+)$/, function (all, safeKey) {
-                var id = Util.unescapeKeyCharacters(safeKey || '');
-                limits[id] = custom[k];
-                return '';
-            });
+            var user;
+            try {
+                user = Keys.parseUser(k);
+            } catch (err) {
+                return void Env.Log.error("PARSE_CUSTOM_LIMIT_BLOCK", {
+                    user: k,
+                    error: err.message,
+                });
+            }
+
+            var unsafeKey = user.pubkey;
+            limits[unsafeKey] = custom[k];
         });
         return limits;
     }(Env.customLimits || {}));
diff --git a/lib/keys.js b/lib/keys.js
new file mode 100644
index 000000000..7eb4ce447
--- /dev/null
+++ b/lib/keys.js
@@ -0,0 +1 @@
+module.exports = require("../www/common/common-signing-keys");
diff --git a/server.js b/server.js
index cca4f2127..2f8dce43b 100644
--- a/server.js
+++ b/server.js
@@ -9,6 +9,7 @@ var Path = require("path");
 var nThen = require("nthen");
 var Util = require("./lib/common-util");
 var Default = require("./lib/defaults");
+var Keys = require("./lib/keys");
 
 var config = require("./lib/load-config");
 
@@ -201,9 +202,11 @@ app.use(/^\/[^\/]*$/, Express.static('customize.dist'));
 var admins = [];
 try {
     admins = (config.adminKeys || []).map(function (k) {
-        k = k.replace(/\/+$/, '');
-        var s = k.split('/');
-        return s[s.length-1].replace(/-/g, '/');
+        // return each admin's "unsafeKey"
+        // this might throw and invalidate all the other admin's keys
+        // but we want to get the admin's attention anyway.
+        // breaking everything is a good way to accomplish that.
+        return Keys.parseUser(k).pubkey;
     });
 } catch (e) { console.error("Can't parse admin keys"); }
 
diff --git a/www/common/common-hash.js b/www/common/common-hash.js
index b60ab3306..cc4344413 100644
--- a/www/common/common-hash.js
+++ b/www/common/common-hash.js
@@ -1,5 +1,5 @@
 (function (window) {
-var factory = function (Util, Crypto, Nacl) {
+var factory = function (Util, Crypto, Keys, Nacl) {
     var Hash = window.CryptPad_Hash = {};
 
     var uint8ArrayToHex = Util.uint8ArrayToHex;
@@ -92,9 +92,7 @@ var factory = function (Util, Crypto, Nacl) {
         }
     };
 
-    Hash.getUserHrefFromKeys = function (origin, username, pubkey) {
-        return origin + '/user/#/1/' + username + '/' + pubkey.replace(/\//g, '-');
-    };
+    Hash.getPublicSigningKeyString = Keys.serialize;
 
     var fixDuplicateSlashes = function (s) {
         return s.replace(/\/+/g, '/');
@@ -568,14 +566,20 @@ Version 1
 };
 
     if (typeof(module) !== 'undefined' && module.exports) {
-        module.exports = factory(require("./common-util"), require("chainpad-crypto"), require("tweetnacl/nacl-fast"));
+        module.exports = factory(
+            require("./common-util"),
+            require("chainpad-crypto"),
+            require("./common-signing-keys"),
+            require("tweetnacl/nacl-fast")
+        );
     } else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
         define([
             '/common/common-util.js',
             '/bower_components/chainpad-crypto/crypto.js',
+            '/common/common-signing-keys.js',
             '/bower_components/tweetnacl/nacl-fast.min.js'
-        ], function (Util, Crypto) {
-            return factory(Util, Crypto, window.nacl);
+        ], function (Util, Crypto, Keys) {
+            return factory(Util, Crypto, Keys, window.nacl);
         });
     } else {
         // unsupported initialization
diff --git a/www/common/common-signing-keys.js b/www/common/common-signing-keys.js
new file mode 100644
index 000000000..15adec7df
--- /dev/null
+++ b/www/common/common-signing-keys.js
@@ -0,0 +1,89 @@
+(function () {
+var factory = function () {
+    var Keys = {};
+
+/*  Parse the new format of "Signing Public Keys".
+    If anything about the input is found to be invalid, return;
+    this will fall back to the old parsing method
+
+
+*/
+    var parseNewUser = function (userString) {
+        if (!/^\[.*?@.*\]$/.test(userString)) { return; }
+        var temp = userString.slice(1, -1);
+        var domain, username, pubkey;
+
+        temp = temp
+        .replace(/\/([a-zA-Z0-9+-]{43}=)$/, function (all, k) {
+            pubkey = k.replace(/-/g, '/');
+            return '';
+        });
+        if (!pubkey) { return; }
+
+        var index = temp.lastIndexOf('@');
+        if (index < 1) { return; }
+
+        domain = temp.slice(index + 1);
+        username = temp.slice(0, index);
+
+        return {
+            domain: domain,
+            user: username,
+            pubkey: pubkey
+        };
+    };
+
+    var isValidUser = function (parsed) {
+        if (!parsed) { return; }
+        if (!(parsed.domain && parsed.user && parsed.pubkey)) { return; }
+        return true;
+    };
+
+    Keys.parseUser = function (user) {
+        var parsed = parseNewUser(user);
+        if (isValidUser(parsed)) { return parsed; }
+
+        var domain, username, pubkey;
+        user.replace(/^https*:\/\/([^\/]+)\/user\/#\/1\/([^\/]+)\/([a-zA-Z0-9+-]{43}=)$/,
+                        function (a, d, u, k) {
+            domain = d;
+            username = u;
+            pubkey = k.replace(/-/g, '/');
+            return '';
+        });
+        if (!domain) { throw new Error("Could not parse user id [" + user + "]"); }
+        return {
+            domain: domain,
+            user: username,
+            pubkey: pubkey
+        };
+    };
+
+/*
+
+0. usernames may contain spaces or many other wacky characters, so enclose the whole thing in square braces so we know its boundaries. If the formatted string does not include these we know it is either a _v1 public key string_ or _an incomplete string_. Start parsing by removing them.
+1. public keys should have a fixed length, so slice them off of the end of the string.
+2. domains cannot include `@`, so find the last occurence of it in the signing key and slice everything thereafter.
+3. the username is everything before the `@`.
+
+*/
+    Keys.serialize = function (origin, username, pubkey) {
+        return '[' +
+            username +
+            '@' +
+            origin.replace(/https*:\/\//, '') +
+            '/' +
+            pubkey.replace(/\//g, '-') +
+        ']';
+        // return origin + '/user/#/1/' + username + '/' + pubkey.replace(/\//g, '-');
+    };
+
+    return Keys;
+};
+
+    if (typeof(module) !== 'undefined' && module.exports) {
+        module.exports = factory();
+    } else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
+        define([], factory);
+    }
+}());
diff --git a/www/settings/inner.js b/www/settings/inner.js
index 234402ab5..df24e71d2 100644
--- a/www/settings/inner.js
+++ b/www/settings/inner.js
@@ -168,7 +168,7 @@ define([
         var publicKey = privateData.edPublic;
         if (publicKey) {
             var $key = $('<div>', { 'class': 'cp-sidebarlayout-element' }).appendTo($div);
-            var userHref = Hash.getUserHrefFromKeys(privateData.origin, accountName, publicKey);
+            var userHref = Hash.getPublicSigningKeyString(privateData.origin, accountName, publicKey);
             var $pubLabel = $('<span>', { 'class': 'label' })
                 .text(Messages.settings_publicSigningKey);
             $key.append($pubLabel).append(UI.dialog.selectable(userHref));
diff --git a/www/teams/inner.js b/www/teams/inner.js
index 30612f3c3..0f3db0829 100644
--- a/www/teams/inner.js
+++ b/www/teams/inner.js
@@ -910,7 +910,7 @@ define([
         var name = team.name;
         if (publicKey) {
             var $key = $('<div>', {'class': 'cp-sidebarlayout-element'}).appendTo($div);
-            var userHref = Hash.getUserHrefFromKeys(privateData.origin, name, publicKey);
+            var userHref = Hash.getPublicSigningKeyString(privateData.origin, name, publicKey);
             var $pubLabel = $('<span>', {'class': 'label'})
                 .text(Messages.settings_publicSigningKey);
             $key.append($pubLabel).append(UI.dialog.selectable(userHref));