diff --git a/lib/commands/quota.js b/lib/commands/quota.js
index 7477929a4..6a8c80bfe 100644
--- a/lib/commands/quota.js
+++ b/lib/commands/quota.js
@@ -36,28 +36,8 @@ Quota.applyCustomLimits = function (Env) {
     var customLimits = (function (custom) {
         var limits = {};
         Object.keys(custom).forEach(function (k) {
-            var user;
-
-            // XXX this length (44) is also hardcoded in decrees.js
-            // before calling Keys.parseUser.
-            // Maybe we should improve Keys.parseUser to handle this
-            // option directly
-            if (k.length === 44) {
-                user = {
-                    pubkey: Util.unescapeKeyCharacters(k)
-                };
-            } else {
-                try {
-                    user = Keys.parseUser(k);
-                } catch (err) {
-                    return void Env.Log.error("PARSE_CUSTOM_LIMIT_BLOCK", {
-                        user: k,
-                        error: err.message,
-                    });
-                }
-            }
-
-            var unsafeKey = user.pubkey;
+            var unsafeKey = Keys.canonicalize(k);
+            if (!unsafeKey) { return; }
             limits[unsafeKey] = custom[k];
         });
         return limits;
diff --git a/lib/decrees.js b/lib/decrees.js
index 9de7d5573..6ecddc0cf 100644
--- a/lib/decrees.js
+++ b/lib/decrees.js
@@ -74,26 +74,13 @@ var Quota = require("./commands/quota");
 var Keys = require("./keys");
 var Util = require("./common-util");
 
-var getCanonicalKey = function (input) {
-    if (typeof(input) !== 'string') { return; }
-    // key is already in simple form. ensure that it is an 'unsafeKey'
-    if (input.length === 44) {
-        return Util.unescapeKeyCharacters(input);
-    }
-    try {
-        return Keys.parseUser(input).pubkey;
-    } catch (err) {
-        return;
-    }
-};
-
 // CryptPad_AsyncStore.rpc.send('ADMIN', [ 'ADMIN_DECREE', ['SET_QUOTA', ['[user@box:3000/VzeS4vP1DF+tXGuq1i50DKYuBL+09Yqy8kGxoUKRzhA=]', { limit: 2 * 1024 * 1024 * 1024, plan: 'buddy', note: "you're welcome" } ] ] ], console.log)
 commands.SET_QUOTA = function (Env, args) {
     if (!Array.isArray(args) || args.length !== 2) {
         throw new Error("INVALID_ARGS");
     }
 
-    var unsafeKey = getCanonicalKey(args[0]);
+    var unsafeKey = Keys.canonicalize(args[0]);
     if (!unsafeKey) {
         throw new Error("INVALID_ARGS");
     }
@@ -119,7 +106,7 @@ commands.RM_QUOTA = function (Env, args) {
         throw new Error("INVALID_ARGS");
     }
 
-    var unsafeKey = getCanonicalKey(args[0]);
+    var unsafeKey = Keys.canonicalize(args[0]);
     if (!unsafeKey) {
         throw new Error("INVALID_ARGS");
     }
diff --git a/www/common/common-signing-keys.js b/www/common/common-signing-keys.js
index 15adec7df..7419f32be 100644
--- a/www/common/common-signing-keys.js
+++ b/www/common/common-signing-keys.js
@@ -2,6 +2,10 @@
 var factory = function () {
     var Keys = {};
 
+    var unescape = function (s) {
+        return s.replace(/-/g, '/');
+    };
+
 /*  Parse the new format of "Signing Public Keys".
     If anything about the input is found to be invalid, return;
     this will fall back to the old parsing method
@@ -15,7 +19,7 @@ var factory = function () {
 
         temp = temp
         .replace(/\/([a-zA-Z0-9+-]{43}=)$/, function (all, k) {
-            pubkey = k.replace(/-/g, '/');
+            pubkey = unescape(k);
             return '';
         });
         if (!pubkey) { return; }
@@ -48,7 +52,7 @@ var factory = function () {
                         function (a, d, u, k) {
             domain = d;
             username = u;
-            pubkey = k.replace(/-/g, '/');
+            pubkey = unescape(k);
             return '';
         });
         if (!domain) { throw new Error("Could not parse user id [" + user + "]"); }
@@ -78,6 +82,19 @@ var factory = function () {
         // return origin + '/user/#/1/' + username + '/' + pubkey.replace(/\//g, '-');
     };
 
+    Keys.canonicalize = function (input) {
+        if (typeof(input) !== 'string') { return; }
+        // key is already in simple form. ensure that it is an 'unsafeKey'
+        if (input.length === 44) {
+            return unescape(input);
+        }
+        try {
+            return Keys.parseUser(input).pubkey;
+        } catch (err) {
+            return;
+        }
+    };
+
     return Keys;
 };